Release credentials custody: Play Console access, signing lineage, Sentry DSN (owner: Altay)

[altaywtf]

Part of #14 (W0 — access and credentials). Owner: Altay — this is account/key custody work agents cannot do. Blocks #31 and #35 (their shared stop condition).

Outcome

Everything needed to ship io.put.putio releases is confirmed, in custody, and documented — before any release lane work starts.

Scope

• Confirm Play Console ownership/access for the io.put.putio listing (live at versionCode 91)
• Locate and verify the upload keystore + signing lineage used by the legacy lane (putio-web/apps/tv-native/android/fastlane/ reads KEYSTORE_PATH/KEYSTORE_PASSWORD/KEY_ALIAS/KEY_PASSWORD from env); confirm whether Play App Signing is enrolled
• Decide keystore custody: workspace pattern suggests a vault repo (putio-code-signing-apple is the Apple analogue — decide Android equivalent: frontend vault payload vs a putio-code-signing-android repo)
• Play API service account (or existing JSON_KEY_FILE account) validated for CI publishing
• Sentry project(s) + DSN for putio-android (mobile and TV surfaces)
• Record all of it in repo docs (custody, recovery, who can cut a release)

Acceptance criteria

• An agent starting Release signing and publishing pipeline in CI (GitHub Environments, SOPS boundary) #49 (CI signing wiring) finds everything it needs documented, with secrets reachable through the workspace secrets contract — no 1Password at CI runtime