Merge branch 'claude/team-key-share-rotate-4b2619'

Two conflicts, and the second is worth recording. main's M4 bullet gained the
Android signing decision while this branch rewrote the M5 line either side of it;
both are kept.

The other is an ADR number collision: two sessions each took 0010, one for vault
key rotation and one for Android distribution, and both are now on main. ADR
numbers are identifiers — "see ADR 0010" appears in code comments as well as in
prose — so leaving two would make every such reference ambiguous. The rotation
ADR landed first and is referenced from crypto.md, the gaps document, ADR 0009
and the sync code; the Android one is referenced from README and android-port.md.
So the later and cheaper one moves: 0010-android-distribution.md is now ADR 0011,
with its title and both references updated. Nothing about either decision changes.

docs/android-port.md

@@ -618,7 +618,7 @@ worth reading is which way each went and why, not that the list is empty.
   API 28 and 29 still cost one branch each in `BiometricGate`, because allowed-authenticator lists arrived
   in 30.
 - ~~**How it is distributed, and what that does to the supply-chain story.**~~ **✅ Settled in
-  [ADR 0010](adr/0010-android-distribution.md): the project holds the release key, the deployment never
+  [ADR 0011](adr/0011-android-distribution.md): the project holds the release key, the deployment never
   serves the client, and Play is deferred.** The question was whether Play App Signing — Google generating
   and holding the release key — is a change to the security property ADR 0001 documents. It is, and the ADR
   takes it as a one-way door rather than a setting: a new Play app must use App Bundles and therefore Play