[stealth 4/4] static leakage checks, CI gates & release/QA policy

[reflog]

Part of epic getlantern/engineering#3569 — stacked PR 4/4, targets stealth/pr3-feature-logging.

Post-processing + static leakage checks (forbidden tokens, native symbols, manifest entries), APK/AAB sanitizer, CI gates, and the release/QA detection matrix + policy docs.

Implements #3628.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds a set of “stealth” Android build post-processing and verification utilities: an artifact sanitizer, a static token leakage scanner with configurable modes, and a Flutter build wrapper for de-branding content, plus tests and documentation describing the intended QA/release policy.

Changes:

• Add check_leakage.py + JSON policy config to scan APK/AAB/ZIP artifacts (including nested archives/metadata) for forbidden identifiers, with unit tests.
• Add sanitize_android_artifact.py to strip selected bundle metadata, scrub brand-only strings from libgojni.so, and optionally re-sign mutated APK/AAB artifacts, with unit tests.
• Add run_flutter_build.py wrapper to de-brand locale .po content, Dart string literals/i18n keys, and brand-named image assets during Flutter builds (restoring sources afterward), plus policy docs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
scripts/stealth/sanitize_android_artifact.py	Implements archive mutation + native brand-string scrubbing and optional APK/AAB re-signing.
scripts/stealth/sanitize_android_artifact_test.py	Adds unit coverage for metadata stripping, scrubbing behavior, and signing invocation behavior.
scripts/stealth/run_flutter_build.py	Adds pre-build de-branding wrapper for locales, Dart literals/keys, and asset renames/replacements.
scripts/stealth/forbidden_tokens.json	Defines forbidden-token categories and scanning modes (stealth / stealth-vpn / stealth-novpn).
scripts/stealth/check_leakage.py	Implements recursive leakage scanning across directories and zip-like archives (incl. metadata/non-entry bytes).
scripts/stealth/check_leakage_test.py	Adds unit tests validating scanner behavior, allowlists, and error handling.
docs/stealth-leakage-checks.md	Documents how to run leakage checks and what each mode is intended to cover.
docs/stealth-builds.md	Documents stealth build QA and release policy, including complementary checks and acceptance criteria.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.