fix(ci): add release-compile safeguard to catch debugImplementation regressions (#336)

- Reverts okhttp.logging dependency from debugImplementation back to
  implementation so it's on the release classpath
- Adds compileReleaseKotlin CI job to catch release-variant compilation
  errors on every PR
- Fixes signing config to allow compileReleaseKotlin without keystore env
  vars (graceful fallback instead of hard require())
- Updates AGENTS.md with dependency scoping pitfall and CI docs

Co-authored-by: M57 <hy4ri@users.noreply.github.com>

AGENTS.md

@@ -42,6 +42,7 @@ find app/src -name '*.kt' | xargs ./ktlint --format   # fix all
 | `android-lint` | Android Lint |
 | `unit-tests` | JUnit |
 | `build` | assembleDebug (gated by the 3 above) |
+| `release-compile` | compileReleaseKotlin — catches release-variant compilation issues (e.g. debugImplementation-scoped deps referenced in main source) |
 | `ci-summary` | Aggregator (`if: always()`) — branch protection gates on THIS check |
 
 Every Gradle job validates `gradle-wrapper.jar` and uses the remote build cache
@@ -145,6 +146,12 @@ gh pr create --title "fix(#N): description" --body "Closes #N"
   `val` at the composable scope first.
 - Don't add new screens without checking if an existing one already covers the
   functionality (19+ screens exist). Extend rather than duplicate.
+- **⚠ Never scope a dependency to `debugImplementation` if its import is used in
+  `main/` source code.** The CI `release-compile` job catches this, but save the
+  cycle. `okhttp3.logging.HttpLoggingInterceptor` is the classic example — it's
+  imported in `ApiClient.kt` (main source) so it must be `implementation`, not
+  `debugImplementation`. If you want it debug-only, wrap the usage in
+  `if (BuildConfig.DEBUG)` or extract it behind an interface.
 
 ## Project Layout