Write down what the phone found, and stop it rotting

docs/android-port.md was an audit of work not started; it now says what is built. Three of
its statements needed correcting rather than extending, and they are marked where they sit:
the Android version question is settled and was never as open as it looked, because
Avalonia.Controls.WebView ships only a net10.0-android36.0 assembly and nothing lower can
resolve it; cleartext to loopback has to be permitted explicitly, which the audit missed
entirely; and the spike produced a structural change it did not anticipate, in
DodoSSH.Client.Shell.

A CI job of its own, because the head is deliberately not in DodoSSH.slnx and a project
outside the solution is a project nobody notices breaking. It packages as well as builds:
a native library with no Android ABI and an assembly that will not dex are both invisible
to a compile, and both are exactly what this head is exposed to.

The README says plainly that signing in is not built, that a fingerprint re-enrolment
destroys the device key, that a notification appears while a shell is open, and that none
of it has run on a device.

.github/workflows/ci.yml

@@ -52,4 +52,51 @@ jobs:
       # server through Testcontainers and runs the API as a child process — so it needs a
       # Docker daemon and gets one here. That is why the tests run on ubuntu rather than
       # macOS, whose runners have no daemon at all. Expect the Keycloak image pull to
-      # dominate a cold run.
+      # dominate a cold run.
+  android:
+    name: android head
+    runs-on: [linux]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
+
+      # A job of its own, because DodoSSH.Client.Android is deliberately not in DodoSSH.slnx.
+      # Adding it there would make the android workload and a full Android SDK a prerequisite of
+      # `dotnet build DodoSSH.slnx` for everyone — including the build job above, which needs
+      # neither and would grow several minutes for a head it does not compile.
+      #
+      # The cost of keeping it out is that nothing in the main job would notice this head
+      # breaking, which for a project sharing view models with the desktop one is a matter of
+      # when rather than whether. This job is that notice.
+      - name: install the android workload
+        run: dotnet workload install android --skip-sign-check
+
+      # API 36 specifically, and it is not a preference: Avalonia.Controls.WebView ships only a
+      # net10.0-android36.0 assembly, so anything lower cannot resolve it and the head loses its
+      # terminal. See docs/android-port.md.
+      - name: install the android sdk platform
+        run: |
+          echo "y" | "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" \
+            "platforms;android-36" "build-tools;36.0.0"
+
+      - name: restore
+        run: dotnet restore src/DodoSSH.Client.Android/DodoSSH.Client.Android.csproj --locked-mode
+
+      - name: build
+        run: >
+          dotnet build src/DodoSSH.Client.Android/DodoSSH.Client.Android.csproj
+          --no-restore --configuration Release
+
+      # Packaging rather than only compiling, because the two failures this head is most exposed to
+      # are both link-time: a native library with no android ABI, and a managed assembly that
+      # resolves for net10.0 but has nothing to dex. Neither shows up in a compile.
+      - name: package
+        run: >
+          dotnet build src/DodoSSH.Client.Android/DodoSSH.Client.Android.csproj
+          --no-restore --configuration Release
+          -t:SignAndroidPackage -p:RuntimeIdentifier=android-arm64