Build every artifact in a pinned image, not on my laptop

Two builder images, because the jobs genuinely need two distributions:
Ubuntu for the tests, the Linux bundle and the Android APK, and Arch for
the .pkg.tar.zst, since makepkg is Arch-specific. Both are built from
this repo (NFR-12) and pinned by tag in the workflows, so a Dockerfile
change only reaches CI once it has been pushed.

libdbus-1-dev is not incidental in the Ubuntu image: btleplug's Linux
backend is bluez-async over the dbus crate, so without it the workspace
does not build at all.

The per-commit Android job is a cargo check, not an APK. The full signed
build is ~15 minutes and runs only on tags; a one-minute check catches
what actually breaks — the JNI shim, droidplug, and any desktop-only API
that has crept into a shared crate.

Two invariants a compiler cannot see are checked there too, because both
fail silently: the app builds, installs, launches, and finds no trainer.
The JNI symbol in android.rs is matched by the runtime by name, so
renaming the Kotlin package compiles fine and simply never initialises
btleplug; and gen/ must stay untracked or the sync script quietly becomes
optional.

The Android versionCode carries a 1000 floor. `tauri android init` writes
1000 for 0.1.0 today, so anyone holding a locally built APK already has
that number installed, and a bare major/minor/patch code would be 100 —
a downgrade, which Android refuses outright.

The fmt check is advisory for now. The tree predates this workflow and
`cargo fmt --all` currently rewrites ~2000 lines across 28 files; making
it a gate here would mean landing a repo-wide reformat as a side effect
of adding CI. Run fmt in its own commit, then drop the continue-on-error.
The two clippy warnings that stood between the tree and a real
`-D warnings` gate are fixed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/ci-set-version.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env sh
+# On a tag build, the tag is the single source of truth for the app version.
+#
+# Only src-tauri/tauri.conf.json is rewritten. That is what the Tauri bundler
+# stamps onto the .deb/.AppImage and what `tauri android init` turns into the
+# Android versionName, so it is the version a user ever sees. The workspace
+# Cargo.toml is deliberately left alone: editing it would invalidate Cargo.lock
+# and break every `--locked` build in the same run, to change a number that
+# appears nowhere but the binary's own metadata.
+#
+# On a non-tag run this is a no-op, so it is safe to call unconditionally.
+#
+# POSIX sh: the runner's /bin/sh is dash.
+set -e
+
+CONF="$(dirname "$0")/../src-tauri/tauri.conf.json"
+
+case "${GITHUB_REF:-}" in
+  refs/tags/v*)
+    VERSION="${GITHUB_REF#refs/tags/v}"
+    echo "Setting app version to $VERSION (from $GITHUB_REF)"
+    sed -i "s/\"version\": \"[^\"]*\"/\"version\": \"$VERSION\"/" "$CONF"
+    ;;
+  *)
+    echo "Not a tag build — keeping the version in tauri.conf.json"
+    ;;
+esac
+
+grep '"version"' "$CONF"