Workload install without build flags; CI variables and the APK key documented

dotnet workload install refuses -nologo. CLAUDE.md lists every variable and
secret the scripts and workflows read; the README gives the APK
certificate's SHA-256.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

tools/release.cs

@@ -301,7 +301,7 @@ string AndroidSdk(string jdk)
 void EnsureWorkload(string name)
 {
   var installed = Capture("dotnet", "workload", "list");
-  if (!installed.Split('\n').Any(l => l.Trim().StartsWith(name + " ", StringComparison.Ordinal))) Dotnet(["workload", "install", name]);
+  if (!installed.Split('\n').Any(l => l.Trim().StartsWith(name + " ", StringComparison.Ordinal))) Run("dotnet", "workload", "install", name);
 }
 
 void WriteSums()