0.2.64 update

README.md

@@ -201,7 +201,29 @@ memby.keyPassword=…
 Without these, `assembleRelease` still builds but the APK is unsigned and will not
 install. The build prints a warning saying so.
 
-### Each release
+### Docker release builder (recommended)
+
+The backend Compose project includes an isolated `memby-builder` service. It keeps the
+Android SDK out of the gateway image, fetches the newest semantic GitHub tag, builds with
+the tagged source's Gradle wrapper, signs with the existing externally mounted keystore,
+verifies the APK and publishes it into the gateway's existing release volume and update
+policy. Admin Console → App updates provides a **Build latest release** button, optional
+exact-tag fallback, required-update confirmation, live status and build output.
+
+After the one-time secret-file setup in [`builder/README.md`](builder/README.md), use the
+Admin Console button. The Linux/NAS command-line fallback remains:
+
+```sh
+docker compose run --rm --build memby-builder release
+```
+
+The signed APK and its checksum are stored in the `memby-releases` volume at
+`/data/releases/memby-<version>.apk` and
+`/data/releases/memby-<version>.apk.sha256`. Gradle downloads are retained in the
+`memby-gradle-cache` volume. The keystore and credentials remain read-only Compose secrets
+under `/run/secrets` and are never copied into the image or repository.
+
+### Local PowerShell release (compatibility path)
 
 ```powershell
 .\release.ps1 -Version 0.1.54 -Notes "Faster home screen" `
@@ -209,13 +231,15 @@ install. The build prints a warning saying so.
   -SourceUrl https://g.sublogue.com/admin/memby
 ```
 
-That bumps `versionName`/`versionCode`, runs the tests, builds a signed APK, and fills
+That existing workflow still bumps `versionName`/`versionCode`, runs the tests, builds a
+signed APK, and fills
 `dist/out/` with:
 
 ```
 index.html            the page people are sent to
 latest.json           the update manifest the app polls
 memby-0.1.54.apk      the build
+memby-0.1.54.apk.sha256  the SHA-256 checksum
 LICENSE               GNU GPL v2 terms
 NOTICE                copyright and third-party acknowledgements
 ```