chore(release): harden mobile build workflow

Promote the reproduced release lessons into harness enforcement: keep tracked native regeneration separate from artifact builds, separate Android build and upload authorization, use stable login readiness in Maestro, and retain the iOS 43 and Android 46 version increments.

.codex/skills/release-mobile/SKILL.md

@@ -9,7 +9,15 @@ Read `docs/releasing.md`, `apps/mobile/RELEASING.md` when present, and the mobil
 scoped instructions. Confirm target platform and release profile. Run repository
 verification plus a native acceptance pass before starting a release build.
 
-Use the package scripts in `apps/mobile/package.json`; preserve platform signing
-and versioning. Building or uploading to a store is an external mutation: obtain
-explicit authorization for the requested target, then report the build artifact,
-version/build number, upload result, and read-back state.
+Before a build from the current upstream branch, fetch, require a clean worktree,
+and prove `HEAD` matches its upstream. Sauci tracks its native iOS and Android
+projects, so routine release builds must package those checked-in sources. Do not
+run `expo prebuild` first; native regeneration is a separate reviewed change.
+
+Use the package scripts in `apps/mobile/package.json`; they create artifacts only.
+Never infer upload or submission authority from build authorization. Store upload
+uses a separately authorized command. Preserve platform signing and local EAS
+versioning. After a build, verify that tracked changes are limited to the expected
+version metadata, then independently read the artifact version and signature.
+Report the artifact, version/build number, upload result when authorized, and
+read-back state.