[isomorphisms]

Make the IB prepaint APK updateable in place across builds.

• refuse to build an installable debug APK with a runner-local ephemeral key;
• use the established persistent public test-only signer in CI;
• pin and verify the certificate;
• update Android SDK setup to avoid the obsolete default tools package;
• perform an initial install followed by two consecutive replacement installs with no uninstall;
• keep test signing explicitly separate from production/store signing;
• record the rule in AGENTS.md.

This changes packaging/acceptance only, not IB browser semantics.