eas: advance OTA fingerprint baseline via repo variable

The OTA pipeline decided OTA-vs-native-rebuild by diffing the current
fingerprint against a baseline commit stored in an actions/cache entry
keyed most-recent-testflight-commit. That cache only saved on a miss but
was restored on every run, so it only advanced when GitHub evicted it.
Once eviction stopped (~June 12), the baseline froze, every fingerprint
looked changed, and OTA deploys silently stopped - every push ran full
native builds instead.

Replace the cache baseline with a repo variable
(MOST_RECENT_TESTFLIGHT_NATIVE_HASH) advanced by a dedicated recordBaseline
job that runs only after both native builds succeed. The fingerprint action
(bumped to the hash-aware v0.3.0) compares the current commit's native hash
against the variable directly, skipping the baseline checkout+reinstall.

recordBaseline is isolated so the PAT that can write repo variables
(EAS_BASELINE_VARIABLE_TOKEN - the built-in GITHUB_TOKEN cannot manage
variables) lives nowhere else in the pipeline, and refuses to write an empty
value. The now-dead cache write steps are removed from the reusable
build-submit-ios/android workflows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/build-submit-android.yml

@@ -170,22 +170,6 @@ jobs:
           payload: |
             {"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
 
-      # Record the commit only after a successful submit, so a failed submit doesn't
-      # advance the "most recent testflight" marker.
-      - name: ⬇️ Restore Cache
-        id: get-base-commit
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        if: ${{ inputs.profile == 'testflight-android' }}
-        with:
-          path: most-recent-testflight-commit.txt
-          key: most-recent-testflight-commit
-
-      - name: ✏️ Write commit hash to cache
-        if: ${{ inputs.profile == 'testflight-android' }}
-        env:
-          GITHUB_SHA: ${{ github.sha }}
-        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
-
   # Runs in parallel with submit: the QA APK shouldn't be blocked by a Play submission failure.
   universalApk:
     name: Build universal APK