Add emulator release gates, JUnit reports and PR artifact links

[andre487]

CI previously relied on JVM/Robolectric tests, exposed test results as downloadable files, and did not require real Android emulator checks before release finalization. This ports the applicable CI and documentation improvements from AndroidMegaProxy through d94f861.

• Run four instrumentation tests independently on API 26 and API 35: real Android Keystore, encrypted settings/queue persistence and retries, HTTP/ACK/redirect behavior, and FileProvider access boundaries. Require both jobs to succeed for the exact release PR head/base; missing or skipped jobs cannot authorize a release. Local runs reject physical devices and non-test AVDs.
• Publish JUnit GitHub Checks and collapsible summaries for Android JVM, emulators, Python, n8n, and signed-build JVM tests. Fork reports use a trusted workflow that parses artifacts without executing PR code.
• Keep separate debug/unsigned APK links in a marked PR description block, preserving author text and rejecting stale runs or malformed markers.
• Update EN/RU testing, release acceptance and Samsung Auto Blocker instructions, including USB/ADB restrictions and restoring protection after installation attempts.

Validation: 66 JVM tests, 17 Python tests, 5 Node tests, and 4 instrumentation tests on each API passed locally. Debug/release lint, APK builds, unsigned APK verification, Black/isort, actionlint and Ruby syntax checks passed. Live n8n smoke was not run locally because Docker was unavailable; the CI server job runs it.

After merge, the workflow_run handlers become active. Add both emulator jobs to branch-protection required checks; GitHub settings are unchanged. Emulator tests do not certify real SMS/notification capture, process death, signed upgrades, OEM behavior or F-Droid reproducibility.

Source comparison and evidence: docs/reviews/megaproxy-sync-2026-10-07.md.