Adopt and verify native Stremio Android baselines

[ruizkinio]

Summary

• replace the stale Stremio Web/Core npm assumption with pinned official native Android APK baselines
• lock Mobile 2.3.2 and Android TV 1.10.4 for arm64-v8a and armeabi-v7a by URL, package, version/code, ABI, APK SHA-256, and Stremio signing certificate
• verify the four APKs with bounded downloads, ZIP ABI inspection, aapt2, and apksigner in protected release readiness
• bind physical phone/TV evidence to its exact device-class and ABI-specific Stremio APK
• require exact same-card replay and a structurally different follow-up source in device UAT

Static APK verification proves artifact identity, not runtime behavior; lifecycle/result-contract inspection and physical UAT remain separate release gates.

Validation

• npm ci
• npm test (27 passed)
• npm audit --omit=dev (0 vulnerabilities)
• node release/validate-release.mjs with authenticated GitHub metadata checks
• direct verification of all 4 pinned native Stremio ARM APKs
• git diff --check