docs: public README + reproducible build image

ci/Dockerfile

@@ -0,0 +1,59 @@
+# straw-build — reproducible Android + Rust build image for the Straw APK.
+#
+# A fully self-contained toolchain so a fresh build needs nothing on the host
+# but Docker. Build it, then run the Gradle assemble inside it:
+#
+#   docker build -t straw-build ci/
+#   docker run --rm -v "$PWD":/src -w /src straw-build \
+#       ./gradlew :strawApp:assembleDebug
+#
+# Toolchain pinned to what builds successfully:
+#   JDK 21 · NDK 27.2.12479018 · build-tools 34.0.0 + 36.0.0 · platforms android-36
+#   Rust stable + 4 Android targets · cargo-ndk · clang/libclang (rquickjs bindgen)
+# AGP (compileSdk 36) requires build-tools 36; we pre-install it so the build
+# doesn't sdkmanager-download it on every run. 34.0.0 is kept as a fallback;
+# apksigner uses the highest build-tools present (36).
+FROM eclipse-temurin:21-jdk-jammy
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    ANDROID_SDK_ROOT=/opt/android-sdk \
+    ANDROID_HOME=/opt/android-sdk \
+    ANDROID_NDK_HOME=/opt/android-sdk/ndk/27.2.12479018 \
+    CARGO_HOME=/opt/cargo \
+    RUSTUP_HOME=/opt/rustup \
+    PATH=/opt/cargo/bin:/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/platform-tools:/usr/bin:/bin
+
+# Base OS deps: clang/libclang for rquickjs bindgen, a C toolchain for the
+# QuickJS C sources, unzip for the SDK zips, git+ca-certs for checkout.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      git curl unzip ca-certificates clang libclang-dev build-essential pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+# Android cmdline-tools + the SDK packages the build needs.
+ARG CMDLINE_TOOLS_ZIP=commandlinetools-linux-11076708_latest.zip
+RUN mkdir -p "$ANDROID_SDK_ROOT/cmdline-tools" \
+    && curl -fsSL -o /tmp/cmdtools.zip "https://dl.google.com/android/repository/${CMDLINE_TOOLS_ZIP}" \
+    && unzip -q /tmp/cmdtools.zip -d "$ANDROID_SDK_ROOT/cmdline-tools" \
+    && mv "$ANDROID_SDK_ROOT/cmdline-tools/cmdline-tools" "$ANDROID_SDK_ROOT/cmdline-tools/latest" \
+    && rm /tmp/cmdtools.zip \
+    && yes | sdkmanager --licenses >/dev/null 2>&1 \
+    && sdkmanager --install \
+         "platform-tools" \
+         "platforms;android-36" \
+         "build-tools;34.0.0" \
+         "build-tools;36.0.0" \
+         "ndk;27.2.12479018" >/dev/null \
+    && rm -rf "$ANDROID_SDK_ROOT/.temp" /tmp/*
+
+# Rust toolchain + the four Android targets + cargo-ndk.
+RUN curl -fsSL https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal \
+    && rustup target add \
+         aarch64-linux-android armv7-linux-androideabi i686-linux-android x86_64-linux-android \
+    && cargo install cargo-ndk --locked \
+    && rm -rf /opt/cargo/registry/cache /opt/cargo/registry/src
+
+# Sanity: fail the image build early if anything's missing.
+RUN java -version && cargo --version && cargo ndk --version || true \
+    && test -d "$ANDROID_NDK_HOME" \
+    && test -d "$ANDROID_SDK_ROOT/build-tools/34.0.0" \
+    && test -d "$ANDROID_SDK_ROOT/build-tools/36.0.0"