Open-source review: balance the README gallery, correct platform docs, add the codeyam CI gates

[jaredcosulich]

Open-source review pass over the repo. Docs and CI only — no app code changes on either platform.

The headline: the README gallery was Android-only

The gallery is generated by codeyam-editor editor readme-sync, which filled its 8-slot cap with a flat take of the name-sorted scenarios. This repo's 26 android-* scenarios sort ahead of its 80 iOS ones, so Android took every slot and zero iOS screenshots appeared — in a README whose hero image is an iPhone. A repo that ships for both platforms read as Android-only.

The gallery here is now 4 iOS + 4 Android, pairing the same state across both platforms.

Note: the root cause is in codeyam-editor, not this repo, and that fix has not shipped yet (it's queued as a plan there). Until it does, readme-sync --check exits 1 against this repo and session-finalize prints a non-blocking "README needs refresh" advisory — and re-running readme-sync with a released binary would revert the gallery to Android-only. The committed content is correct; it just isn't reproducible from a released binary yet.

Corrected platform facts

• compile SDK 34 → 35 in README and CONTRIBUTING. android/app/build.gradle.kts has compileSdk/targetSdk = 35, and the CHANGELOG already said API 35 — the setup docs were the outlier.
• The documented launch command didn't work. Both README and CONTRIBUTING said codeyam-editor editor, which exits 2 — that's the subcommand group, not a launcher. Now codeyam-editor start. (Also fixed upstream, since it shipped in every codeyam-generated README.)
• Paparazzi was undocumented. CI runs verifyPaparazziDebug, but CONTRIBUTING listed only compileDebugKotlin + testDebugUnitTest. A contributor changing a Compose component passed locally and failed CI with no warning. Now documented with the recordPaparazziDebug re-record path and the caveat that re-recording passes the check by definition.
• store/playstore/README.md pointed at play-release.yml's retired predecessor play-internal.yml, and carried a "make the privacy policy OS-neutral" to-do that already shipped.

CI: the codeyam merge-readiness gates were missing

ci.yml proved the code builds and its tests pass, but nothing checked the codeyam state that travels with it. The CLI documents verify-no-deferred-finalize / verify-full-finalize / verify-completed-plans as "CI runs it on PRs to the primary branch as the authoritative backstop" — this repo relied solely on the local pre-push hook, which a fork or a --no-verify push bypasses.

Adds codeyam-protection.yml from the upstream template, extended with verify-completed-plans. Kept separate from ci.yml so a metadata-debt failure reads as metadata debt, not a broken app. All three gates were verified green against the published npm build before being wired up.

Also aligns ci.yml / testflight.yml onto the action versions play-release.yml already used (checkout v5, setup-java v5, setup-android v4).

Verification

• codeyam-editor editor session-finalize — passed, marker re-stamped
• verify-full-finalize — exit 0 (branch is merge-ready)
• editor audit — 150 glossary entries, 150 tests covered, no stale/missing scenarios, screenshots, or tests
• presentability-scan — clean with the fixed scanner
• Working tree clean; finalize required no state changes

Needs a separate decision (not in this PR)

Branch protection on main requires a status check named Build & test, which no workflow produces — the CI jobs are named iOS · Build & test and Android · Build & test, renamed when the Android port landed. The required check is dangling, so it can never go green; only enforce_admins: false has been masking it. See the PR discussion for the fix.