feat(workout): add mobile release kit command

Add one canonical Workout mobile release command that builds the production server and writes Android/iOS shell metadata, explicit production policy, and honest external signing/toolchain blockers.

req: examples/001

req: examples/006

req: host/002

req: local/001

examples/workout/README.md

@@ -57,6 +57,23 @@ serves the shared hemx runtime through `hemx-axum`; there is no frontend build,
 Node runtime, Expo/Ionic/Tauri shell, or handwritten selector UI JavaScript to
 ship. req: axum_integration/005 req: examples/005
 
+## Mobile release kit
+
+Use the canonical release command to build the production server binary and
+write Android/iOS shell metadata:
+
+```sh
+HEMX_WORKOUT_ORIGIN=https://workout.example.com \
+  cargo run -p hemx-xtask -- workout-mobile release
+```
+
+The kit lands in `target/hemx-mobile/workout` unless
+`HEMX_WORKOUT_MOBILE_OUT` is set. It records app identity, version, production
+origin, runtime asset policy, cache/offline state policy, secrets/signing
+boundaries, rollback expectations, Android TWA metadata, iOS WebView metadata,
+and any external blocker such as missing Android SDK, Xcode, or store signing
+credentials. See `docs/recipes/mobile-release.md`. req: examples/006
+
 ## Boundaries proven
 
 - Core workout logging works without network availability once the page/runtime