CI hardening: fast-fail check job (lockfile/tsc/eslint) gates the APK build + optional ntfy alerts; config plugin makes 'expo prebuild' preserve release signing/versioning; node 22 pinned with docker lock script + pre-push hook

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.githooks/pre-push

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Reject pushes whose lockfile CI's npm (node 22) would refuse — a lock
+# written by a newer local npm fails `npm ci` on the runner half a build in.
+# Enable with: git config core.hooksPath .githooks
+set -e
+root=$(git rev-parse --show-toplevel)
+if git diff --quiet origin/main...HEAD -- app/package.json app/package-lock.json 2>/dev/null; then
+  exit 0
+fi
+echo "pre-push: package.json/lock changed — validating with CI's npm (node:22)…"
+docker run --rm -v "$root/app:/w" -w /w node:22 npm ci --dry-run --no-audit --no-fund >/dev/null
+echo "pre-push: lockfile OK"