fix(ios,android): close the acceptance gaps the review found, add Android CI

- T-iOS-34's stated acceptance is "最大字号不破版" and it was failing: the key bar
  froze its height at 52pt while an AX5 keycap needs 108.24pt, so caps clipped —
  recorded as a withKnownIssue rather than fixed. Height now derives from the
  content size category (and tracks live changes via registerForTraitChanges);
  the known-issue marker is gone, replaced by positive assertions including a
  12-category no-clip sweep and a guard that stays red if anyone writes the
  constant back. Honest tradeoff: the keycap font is clamped at .accessibility2,
  the same policy the design system already applies to dense content, because an
  unclamped AX5 bar would eat the terminal. A test pins the clamp so the two
  cannot drift.

- Thumbnails silently 401'd on a token-gated host: the pipeline built its own
  transport with no token source, and by design never throws, so every preview
  degraded to a placeholder with no signal. Assembled from AppEnvironment now.

- Android had zero CI while the token wave shipped 24 files of secret-handling
  code. The instrumented leg is workflow_dispatch-only and says why in the file:
  no one has ever seen it green on a runner, and a required leg nobody trusts
  just produces a false green.

- Android persisted a validated token before the host probe succeeded, stranding
  a secret for a host that never paired.

App bundle 534 -> 550 on both simulators, zero known issues. Android 687 -> 691.

ios/README.md

@@ -288,9 +288,13 @@ remotely, watch status, and reattach with full scrollback.
   foreground contrast. Dynamic Type up to **AX5** is measured, not assumed:
   gate banner, telemetry chips and meta rows are asserted not to overflow 320 pt,
   with a numeric clamp keeping tabular figures from blowing up the layout.
-  **Known gap (measured, not fixed):** the fixed 52 pt key-bar needs ~108 pt at
-  AX5, so key caps clip — recorded as a `withKnownIssue` in
-  `DynamicTypeLayoutTests` so the test starts complaining once it is fixed.
+  The key-bar height is derived from the content size category rather than
+  frozen at 52 pt, so nothing clips at any size. Its keycap **font** is clamped
+  at `.accessibilityLarge` — the same dense-content policy the design system
+  already applies to telemetry chips — because an unclamped AX5 bar wants
+  ~108 pt of the 17-key strip and would eat the terminal. So AX3–AX5 render
+  keycaps at AX2 size; a test pins the clamp to the design-system constant so
+  the two cannot drift, and another keeps the bar at exactly 52 pt for XS–XL.
 - **Project git panel** — the ambient git state the server has served since w6,
   now on the phone: a **sync band** (`↑ahead ↓behind`, upstream, detached-HEAD
   and fetch-staleness states — green "in sync" *only* when `↑0 ↓0` **and** the