Bind XCM evidence to Android release commit

[takemiyamakoto]

Summary

• require Android XCM production evidence records to carry androidCommit
• compare ready evidence against the Android release commit or XCM_PRODUCTION_EXPECTED_COMMIT
• update the evidence template, release checklist, and adversarial tests

Verification

• bash -n scripts/audit-xcm-production-evidence.sh scripts/generate-xcm-production-evidence-template.sh scripts/test-xcm-production-evidence-audit.sh scripts/test-xcm-production-evidence-template.sh
• bash scripts/test-xcm-production-evidence-template.sh
• bash scripts/test-xcm-production-evidence-audit.sh
• bash scripts/audit-xcm-production-evidence.sh
• bash scripts/generate-xcm-production-evidence-template.sh --output build/reports/xcm-production-evidence-template.json
• git diff --check

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.