load android signing secrets from SOPS for local builds

Keystore is decoded into /dev/shm (tmpfs, RAM-only) during the build
and cleaned up on exit — never written to physical disk. ANDROID_KEYSTORE_PATH
is now required with no fallback; missing it fails loudly. Dagger CI path
updated to write to /tmp and set ANDROID_KEYSTORE_PATH accordingly.

Also fix check_ci_images.sh: filter out incomplete image tags ending in ':'
that arise from dynamic From("image:"+variable) concatenations.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/check_ci_images.sh

@@ -7,7 +7,7 @@ ROOT=$(git rev-parse --show-toplevel)
 FILE="$ROOT/ci/main.go"
 
 # Static images from From("...") literals in ci/main.go
-static_images=$(grep -oP 'From\("\K[^"]+' "$FILE" | sort -u)
+static_images=$(grep -oP 'From\("\K[^"]+' "$FILE" | grep -v ':$' | sort -u)
 
 # Dynamic Flutter image derived from .fvmrc (not a literal in main.go)
 FVMRC="$ROOT/.fvmrc"