M6: release signing, privacy policy and Play release checklist

CHANGELOG.md

@@ -12,6 +12,15 @@ upload needs a **higher `versionCode`** than every previous upload.
 
 ### Added
 
+- **M6 — release config and Play readiness.** An upload keystore (4096-bit RSA,
+  `CN=Hadrian Burkhardt, L=Potsdam, C=DE`) is generated and wired through the git-ignored
+  `keystore.properties`, so `bundleRelease` produces a signed, R8-minified, resource-shrunk
+  `.aab` (4 682 814 bytes) and `assembleRelease` a signed APK. `docs/PLAY_RELEASE_CHECKLIST.md`
+  walks the Play Console work, with step 4 covering the **Permissions Declaration Form** for
+  "All files access" — the declaration a file manager must make, and the one that can block
+  a release. `PRIVACY.md` is written to match the shipped permissions: no collection, no
+  sharing, no `INTERNET`. The shipped permission set is audited from the release APK.
+
 - **M5 — analysis, archives and viewers.** `domain/UsageAnalysis` rolls up recursive folder
   sizes and finds the largest files below a folder, which the new storage-usage screen
   shows as a size and a share bar per row. `domain/ArchiveEngine` creates ZIP archives and