android: bind the bridge to a confirmed origin and stop shipping a mailbox

- The native bridge answers only the kernel's page and the one computer the
  person scanned a code for; `openInApp` loads an origin once, and only that one.
- Non-web URLs are routed only for mailto: and tel: — an intent:// URL can start
  any exported activity.
- The `reasonix://` filter that nothing handled is gone.
- A release with no key is unsigned instead of signed with the debug key, and the
  debug build no longer wears the release key.
- The Gradle wrapper is pinned by checksum and the mirrors are out of the
  repository.
- The scripts find the kernel and the page at the repository root, speak English,
  and copy LICENSE from it instead of committing a second copy.
- The README is what a builder needs, and states what the permissions cost.

android/app/src/main/java/io/reasonix/mobile/app/MainActivity.kt

@@ -635,7 +635,12 @@ class MainActivity : AppCompatActivity() {
                 // computer's Studio, so its own links belong in here rather than
                 // in a browser with no way back.
                 val kernelOrigin = (application as App).kernel.origin
-                if (kernelOrigin != null && url.toString().startsWith(kernelOrigin)) return false
+                // Exact origins, not a string prefix: `http://127.0.0.1:50001/`
+                // starts with `http://127.0.0.1:5000` and would be read as the
+                // kernel's own page, which is how a host on a nearby port gets
+                // treated as this app's. `originOf` keeps the port, so the two
+                // are compared as the origins they are.
+                if (kernelOrigin != null && originOf(url) == kernelOrigin) return false
                 if (inAppOrigin != null && originOf(url) == inAppOrigin) return false
                 // Anything else belongs in the real browser: a documentation
                 // link, a provider's console, a sign-in page. Loading one inside