- Remove committed release keystore + hardcoded signing password - Load signing config from gitignored app/keystore.properties - Add single-use token guard (fail-open) to block on-device approval replay
- Remove committed release keystore + hardcoded signing password - Load signing config from gitignored app/keystore.properties - Add single-use token guard (fail-open) to block on-device approval replay