You are Worker F2 on the Bookshelf project (~/bookshelf). Wave 4, part 2:
SHOW THE OWNER WHAT IT LOOKS LIKE, AND SHIP AN INSTALLABLE APK.

FIRST READ (contract — follow exactly, do not restate):
  ~/bookshelf/docs/SPEC.md     (see "Design language", "Screens", "Quality bar")
  ~/bookshelf/docs/HANDOFF.md  (state + hazards already paid for — read the hazards)

Waves 1-3 are DONE and verified: 91 unit tests pass, all six screens exist, and there
is an existing Paparazzi setup (`ComponentGalleryPaparazziTest`, 10 PNGs of the shared
components) that ALREADY WORKS — `~/bookshelf/tasks/gw recordPaparazziDebug` is green.
Follow its patterns rather than inventing a new approach.

Context that shapes this task: there is NO EMULATOR on this box (no KVM). Nothing in
this project has ever actually been RUN — only compiled and unit-tested. Your screenshots
are the ONLY way the owner can judge how their library app looks, and the signed APK is
the only way they can run it for real. Both matter more than usual.

## Your scope
1. **Paparazzi screenshots of all SIX screens** — setup, library, detail, scan,
   locations, settings — each in BOTH light and dark. Render them with realistic
   populated state (a plausible shelf of books, covers as placeholder art), NOT empty
   states, plus the library empty state as its own shot since SPEC calls it out.
   The scan screen cannot show a live camera in Paparazzi — render its overlay/reticle
   and the result bottom sheet over a static backdrop, and say so in your report.
2. **Release signing + signed APK.** Generate a release keystore, wire a signingConfig
   into `app/app/build.gradle.kts`, and produce a signed release APK. Keystore and its
   passwords MUST be gitignored — put credentials in `app/keystore.properties` (gitignored)
   and read them from the build file, with a graceful fallback so the build still works
   for anyone without the keystore. Record the passwords in `app/keystore.properties` and
   state them in your report so the owner can rebuild.
   `minifyEnabled` is currently false for release — if you enable R8, you must prove the
   signed APK still builds AND that Room/Retrofit/kotlinx-serialization/ML Kit survive it
   (proguard rules). If you cannot prove it, leave R8 off and say so.
3. **Top-level `README.md`** — what the project is, the two-person shared-library model,
   architecture (offline-first Room + PocketBase, push-then-pull LWW sync), how to build,
   how to deploy the server (point at `server/deploy/`), how to install the APK, and an
   honest "current limitations" section. Reuse the real content in `server/README.md` and
   `docs/SPEC.md`; do not contradict them.

## Boundaries — Worker F1 is running RIGHT NOW in this repo
- F1 owns `server/` and live-server sync testing, in package `org.modg.bookshelf.livesync`.
  DO NOT touch `server/` or anything under that package.
- F1 may be fixing bugs in data.repo / data.remote / data.local. DO NOT edit those
  packages. If a screenshot needs a data-layer change, REPORT it instead.
- You own `app/app/build.gradle.kts`, the root `README.md`, and all screenshot code.
- Do not modify the six screens' behavior to make them easier to screenshot. If a screen
  is hard to render in isolation, that is a finding to report, not a licence to change it.

## Build/verify — use the serialized wrapper, never ./gradlew directly
    ~/bookshelf/tasks/gw assembleDebug
    ~/bookshelf/tasks/gw testDebugUnitTest
    ~/bookshelf/tasks/gw recordPaparazziDebug
    ~/bookshelf/tasks/gw assembleRelease

## Definition of done — actually run these, wait for them, report REAL exit codes
1. All four commands above exit 0. `testDebugUnitTest` keeps ZERO failures (91 tests
   currently pass — do not break them).
2. Screenshot PNGs exist on disk for all six screens x light/dark. List their paths.
3. A signed release APK exists. Give its exact path, size, and the output of
   `~/toolchain/android-sdk/build-tools/37.0.0/apksigner verify --print-certs <apk>`
   (or an explanation if that tool is unavailable).
4. Do NOT commit the keystore or its passwords to git. Verify with `git status`.

## Do not repeat an earlier worker's mistake
A worker once ended its turn saying "tests are running in the background, I'll report
when done." That is a FAILURE. Run it, WAIT, report observed exit codes. A truthfully
reported gap is worth more than a false green.

## Report (short — read by a token-constrained orchestrator)
- real exit codes for all four commands
- the screenshot PNG paths, and the signed APK path + size + signer info
- anything in SPEC's design language you think the screens get WRONG, now that you can
  finally see them rendered. Be candid — the owner explicitly cares how this looks.