build: target amd64 — Google ships no arm64 Linux build-tools

The image pinned build-tools 36.0.0, whose aapt2/d8 are x86_64-only (Google
publishes no arm64 Linux build-tools). Built for and run on arm64, packaging
died with `aapt2: Syntax error: newline unexpected` (an x86_64 binary the
kernel can't exec).

Build the image for linux/amd64 on an amd64 runner, and point the template +
README at ubuntu-24.04. The APK output is architecture-neutral, so this costs
nothing downstream. Also execute aapt2 in the image sanity check so an arch
mismatch fails the image build, not every app build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -1,7 +1,9 @@
-# Native linux/arm64 Android build toolchain for CI.
+# Native linux/amd64 Android build toolchain for CI.
 # Builds release artifacts only — no emulator, no test/system images.
-# eclipse-temurin publishes a native linux/arm64 manifest, so this runs
-# without emulation on an OCI Ampere (aarch64) runner.
+# Must be amd64: Google publishes the Linux build-tools (aapt2, d8, …) for
+# x86_64 only — there is no arm64 Linux build-tools package — so packaging
+# cannot run natively on an aarch64 runner. The APK output is architecture-
+# neutral regardless of the build host.
 FROM eclipse-temurin:21-jdk-noble
 
 # --- Version pins (bump deliberately; this is what your app repos trust) ---
@@ -40,9 +42,8 @@ RUN mkdir -p ${ANDROID_SDK_ROOT}/cmdline-tools && \
 ENV PATH=${PATH}:${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin:${ANDROID_SDK_ROOT}/platform-tools
 
 # Accept licenses and bake the SDK packages into the image so prod builds
-# don't depend on Google's endpoint at job time.
-# aapt2 and the build-tools binaries ship native arm64 for 35.x, so APK/AAB
-# packaging runs natively on aarch64.
+# don't depend on Google's endpoint at job time. The build-tools binaries
+# (aapt2, d8) are x86_64 ELF — this is why the image must be amd64.
 RUN yes | sdkmanager --licenses >/dev/null && \
     sdkmanager --install \
       "platform-tools" \
@@ -51,7 +52,10 @@ RUN yes | sdkmanager --licenses >/dev/null && \
     rm -rf ${ANDROID_SDK_ROOT}/.android
 
 # Sanity: fail the image build if the toolchain isn't actually usable.
+# Execute aapt2 (not just --version a tool) so an arch mismatch in the
+# build-tools binaries fails the image build here, not in every app build.
 RUN java -version && sdkmanager --version && node --version && \
+    "${ANDROID_SDK_ROOT}/build-tools/${BUILD_TOOLS_VERSION}/aapt2" version && \
     test -d "${ANDROID_SDK_ROOT}/platforms/${PLATFORM_VERSION}"
 
 WORKDIR /workspace