feat(mobile): wire expo-updates to the self-hosted XPREM OTA server

Install expo-updates and the eoas CLI, and configure the client against
https://ota.apps.jbrunton.co.uk.

app.json stays the static source of truth for version, buildNumber, and
versionCode, which EAS rewrites during a release build. A new app.config.js
spreads it and layers on the updates block, because XPREM selects a release
channel from a build-time request header and that value differs per EAS
build profile.

- updates.url points at the XPREM manifest endpoint, /manifest
- runtimeVersion uses the appVersion policy, so the runtime version is the
  store-visible expo.version and a native change requires a store build
- expo-channel-name comes from RELEASE_CHANNEL, set per EAS build profile:
  development, staging (preview profile), and production
- expo-app-id and an empty xprem-branch header are declared at build time,
  since expo-updates only sends headers that existed when the build was made
- code signing uses keyid main and rsa-v1_5-sha256 against a certificate at
  certs/certificate.pem, skipped when DISABLE_CODE_SIGNING is set so a dev
  client can run against the packager

The XPREM app id and the code-signing certificate are still placeholders
pending the update server deployment. The config throws a descriptive error
whenever RELEASE_CHANNEL is set while either is unresolved, so a
misconfigured build fails at config resolution rather than shipping a client
that can never validate a manifest.

The native projects are Expo CNG output and are left untouched: the
expo-updates config plugin embeds the real app id and certificate contents,
so they are regenerated as a reviewed source change once both values land.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/mobile/package.json

@@ -18,7 +18,11 @@
     "release:ios:preview": "dotenv -e .env -- eas build --platform ios --profile preview --local",
     "release:android": "dotenv -e .env -- eas build --platform android --profile production --local",
     "release:android:preview": "dotenv -e .env -- eas build --platform android --profile preview --local",
-    "release:android:upload": "bundle exec fastlane android upload"
+    "release:android:upload": "bundle exec fastlane android upload",
+    "ota:publish:staging": "RELEASE_CHANNEL=staging eoas publish --branch staging",
+    "ota:publish:production": "RELEASE_CHANNEL=production eoas publish --branch production",
+    "ota:rollback": "eoas rollback",
+    "ota:doctor": "eoas doctor"
   },
   "dependencies": {
     "@bacons/apple-targets": "^0.1.6",
@@ -62,6 +66,7 @@
     "expo-secure-store": "~15.0.8",
     "expo-sharing": "~14.0.8",
     "expo-status-bar": "~3.0.9",
+    "expo-updates": "~29.0.20",
     "react": "19.1.0",
     "react-dom": "19.1.0",
     "react-native": "0.81.5",
@@ -87,6 +92,7 @@
     "@types/react": "~19.1.10",
     "@types/react-test-renderer": "^19.1.0",
     "dotenv-cli": "^11.0.0",
+    "eoas": "^3.1.3",
     "eslint": "^8.57.0",
     "eslint-config-expo": "~10.0.0",
     "jest": "^29.7.0",