Owner decision: keep app/google-services.json committed, or inject it as a release secret (#548 item 4)

[monkopedia-reviewer]

Carving item 4 of #548 out into its own issue so it does not disappear when #548 closes on PR #584.

#548's triage comment scoped that issue to items 1-3 and said of item 4:

Out of scope — item 4, do not action: "restore the property by not committing google-services.json." Removing that file means a -Pgoogle build needs the credentials injected from a secret that only the owner controls, so it changes what the release workflow requires to run at all. Flag it, leave it.

PR #584 closes #548 having done items 1-3. Item 4 is a live owner decision with nothing tracking it, and a decision recorded only in a comment on a closed issue is invisible to every open-state sweep.

The decision

app/google-services.json is committed. Two consequences, both real:

1. The google-services plugin's hard-fail-on-missing-credentials never fires, because the credentials are always present. ci: verify FOSS purity against the built APK (#548) #584 corrected the comment in app/build.gradle.kts that claimed this was a safety property of the FOSS/Google split — it is not, and ci: verify FOSS purity against the built APK (#548) #584's scripts/check-apk-distribution.sh is what actually guards the split now.
2. Removing the file would mean a -Pgoogle build has to inject credentials from a secret only the owner controls, changing what release.yml needs to run at all.

So: leave it committed (status quo — the purity gate now covers what the hard-fail was mistakenly credited with), or remove it and wire the credentials in as a release secret.

No action until the owner rules.