fix: harden Android build and packaging pipeline

[V3RON]

What is this?

This PR hardens the Android build process against the two failure classes uncovered while triaging #209:

1. Broken npm tarballs. v2.1.0 shipped without android/CMakeLists.txt because the files allowlist in packages/android-client/package.json wasn't updated when the native build was introduced — every consumer's Android build broke until v2.1.1. CI never caught it because it builds from workspace links, which always see the full source tree.
2. Per-ABI native regressions. Android build fails for armeabi-v7a linking voltra_js_renderer: undefined JSI/Hermes symbols on RN 0.86 / Expo 57 #209 reports libvoltra_js_renderer.so failing to link JSI/Hermes symbols on armeabi-v7a only. The report did not reproduce on a clean install (all upstream prefab artifacts and a pristine Expo 57 / RN 0.86 build check out), but it exposed that CI never compiles the 32-bit ABIs, so a real regression of that shape would ship unnoticed.

It also fixes two adjacent issues in packages/android-client/android/build.gradle: the library ignored the app's reactNativeArchitectures selection, and the packagingOptions excludes still referenced the old libhermes.so name, so the renamed libhermesvm.so (~2 MB per ABI, already provided by the host app's React Native runtime) was bundled into build outputs.

How does it work?

• android-tarball-build CI job exercises the real consumer path end to end: it packs @use-voltra/android-client, installs the tarball (not the workspace symlink) into the example app, runs expo prebuild, and builds the native library with -PreactNativeArchitectures=armeabi-v7a,arm64-v8a,x86,x86_64. A file missing from the tarball breaks prebuild or CMake configure; a per-ABI link regression breaks the targeted externalNativeBuildDebug task. Scoping the Gradle invocation to that one task keeps the job well under a full app assembly. Rather than asserting a curated list of "critical files" (which invites false confidence — what belongs in the tarball can't be enumerated deterministically), the job relies on hard evidence: the packed artifact either builds or it doesn't. The job's GITHUB_TOKEN is restricted to contents: read.
• build.gradle gains the React Native template convention: a reactNativeArchitectures() helper feeding ndk.abiFilters, so the standalone Hermes runtime is only compiled for the ABIs the app actually ships, and apps that restrict architectures no longer pay for (or trip over) the ones they exclude. The packaging excludes now cover libhermesvm.so alongside the legacy libhermes.so.

Why is this useful?

• A v2.1.0-style broken release becomes impossible to ship silently: the tarball-install build fails CI before publish.
• Per-ABI link breakage — the failure mode alleged in Android build fails for armeabi-v7a linking voltra_js_renderer: undefined JSI/Hermes symbols on RN 0.86 / Expo 57 #209 — is now exercised on every PR for all four architectures instead of being discovered by users at expo run:android time.
• Apps setting reactNativeArchitectures get matching native builds from Voltra instead of the library unconditionally building all four ABIs.
• Build outputs no longer carry a duplicate Hermes engine copy, avoiding wasted APK size and duplicate-library packaging conflicts.