Move APK runner to a separate host; openssl-based keystore

- gen-keystore.sh now builds a PKCS12 keystore with openssl (no JDK/keytool),
  and signing.gradle declares storeType PKCS12.
- Runner is meant to run on a roomy server (the app host lacks disk for the
  Android SDK); added runner/README.md with deployment steps. Removed the
  runner that was registered on the app host.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ci/signing.gradle

@@ -13,6 +13,7 @@ gradle.projectsLoaded {
                     signingConfigs {
                         campscanRelease {
                             storeFile file(storeFilePath)
+                            storeType 'PKCS12'
                             storePassword System.getenv('CAMPSCAN_STORE_PASSWORD')
                             keyAlias System.getenv('CAMPSCAN_KEY_ALIAS')
                             keyPassword System.getenv('CAMPSCAN_KEY_PASSWORD')