ci(android): guard mobile security and app identity

.github/workflows/android.yml

@@ -48,6 +48,15 @@ jobs:
         with:
           gradle-version: '8.13'
 
+      - name: Validate mobile security and identity contract
+        run: |
+          set -Eeuo pipefail
+          grep -Fq 'applicationId = "com.korexlabs.dhinspeccion"' android-app/app/build.gradle.kts
+          grep -Fq 'applicationIdSuffix = ".debug"' android-app/app/build.gradle.kts
+          grep -Fq 'buildConfigField("String", "API_BASE_URL", "\"https://dhv2.korexlabs.com/api/v3/\"")' android-app/app/build.gradle.kts
+          grep -Fq 'android:allowBackup="false"' android-app/app/src/main/AndroidManifest.xml
+          grep -Fq 'android:usesCleartextTraffic="false"' android-app/app/src/main/AndroidManifest.xml
+
       - name: Android lint
         working-directory: android-app
         run: gradle --no-daemon :app:lintDebug