ci: address release review comments

Author: ovitrif

README.md

@@ -18,6 +18,22 @@ Download `google-services.json` from the Firebase Console when you need real Fir
 - mainnetDebug: Place in `app/src/mainnetDebug/google-services.json`
 - mainnetRelease: Place in `app/src/mainnetRelease/google-services.json`
 
+The debug files above are tracked placeholders. Before replacing a debug placeholder with a real Firebase config, hide that local-only change from Git:
+
+```sh
+git update-index --skip-worktree app/src/devDebug/google-services.json
+cp /secure/path/google-services.json app/src/devDebug/google-services.json
+```
+
+Repeat with the `tnetDebug` or `mainnetDebug` path when testing those debug variants.
+
+When you are done testing, restore the tracked placeholder:
+
+```sh
+git update-index --no-skip-worktree app/src/devDebug/google-services.json
+git restore app/src/devDebug/google-services.json
+```
+
 > **Note**: Placeholder debug configs are only for local builds. FCM token registration and push notifications require real Firebase configuration. The mainnet release flavor will fail to build without the `mainnetRelease/google-services.json` file.
 
 #### 2. GitHub Packages setup

scripts/reproduce-release.sh

@@ -7,7 +7,7 @@ cd "$repo_root"
 output_dir=${OUTPUT_DIR:-.ai/reproducible-release}
 bundletool_version=${BUNDLETOOL_VERSION:-1.18.1}
 bundletool_sha256=${BUNDLETOOL_SHA256:-a73341a7945abcb0e6b8971c7b1b2801bd765006447ca0d2437a4260d572ceac}
-bundletool_url=${BUNDLETOOL_URL:-https://repo1.maven.org/maven2/com/android/tools/build/bundletool/${bundletool_version}/bundletool-${bundletool_version}.jar}
+bundletool_url=${BUNDLETOOL_URL:-https://dl.google.com/dl/android/maven2/com/android/tools/build/bundletool/${bundletool_version}/bundletool-${bundletool_version}.jar}
 bundletool_jar=${BUNDLETOOL_JAR:-${output_dir}/tools/bundletool-${bundletool_version}.jar}
 
 artifacts_dir="$output_dir/artifacts"