chore(release): prepare Nova 1.3.7

[papi-ux]

What

Prepare Nova v1.3.7 from current master aa69ebcb2d2c5ffc4cbf09876878466848e92c2f.

• bumps versionName to 1.3.7 and versionCode to 39
• adds the 1.3.7 changelog and Google Play note
• binds all build lanes to the event source, requires the peeled remote release tag to match the verified build commit, and extracts the exact dated changelog section
• stages new and existing GitHub releases as drafts, verifies the body before uploading the exact three APK and three checksum assets, then republishes only after asset verification; reruns revalidate the tag and source
• advances the release metadata contract and public-doc metadata inventory
• describes Report a problem, the session_overridable picker behavior, Ctrl+1/Ctrl+2 Quick Keys, and the exact-release README refresh
• blocks controller activation from escaping a disabled, focusable display-mode card
• includes the Kotlin cache containment from ci(security): disable vulnerable Kotlin cache paths #243 and the subtle GitHub Sponsor action from feat(ui): add subtle sponsor link #244
• adds the canonical public papi-ux Matrix Space to the README and beside Sponsor in the System sheet
• reserves independent 48dp Matrix and Sponsor touch targets while keeping their compact typography and placement

Why

The fixes intended for this patch release have landed while Android and store metadata still identify 1.3.6 / 38. These pins must move together before an exact signed candidate can be produced and tested.

The first signed RP6 acceptance found one release blocker: when Polaris correctly exposed Headless Dongle as session_overridable=false, Nova rendered its card disabled and focusable, but physical Xbox A bubbled to an ancestor and selected it anyway. The corrected card consumes activation keys while leaving controller navigation and the host-supplied reason intact.

Impact and boundaries

This is release preparation only. It does not create a tag or GitHub release.

The manual Report a problem action is described exactly as shipped: bounded logs and a one-time crash marker are redacted and handed to Android's system share sheet. Client transport support for a capable Polaris host exists, but the user-facing action is not wired to it and automatic upload is not claimed.

The Matrix action opens the canonical public Space invite, https://matrix.to/#/#papi-ux:papi-ux.com, through the existing external URL launcher. It adds no embedded chat SDK, account flow, or background service.

The changelog and executable metadata contract now pin August 19. If publication slips to another date, both must move together before tagging.

Matched publication waits on refreshed exact-candidate Polaris #479 and Nova #242 physical evidence plus signer continuity. This PR remains draft.

Checks

• focused release, Matrix, System, and help contracts passed
• Android production and instrumentation-test compilation passed
• all five disabled-picker activation keys are covered: A, center, Enter, numpad Enter, and Space
• Matrix and Sponsor callback blocks are pinned separately, with independent 48dp touch targets
• release-note extractor: 4 fail-closed tests plus the exact v1.3.7 output
• publication contract pins all three checkouts, exact tag-to-build binding, draft staging for both new and existing releases, pre-upload body verification, the exact six-file asset set, and publish-last ordering
• bash scripts/check-public-docs.sh
• bash scripts/check-public-surface.sh
• Google Play note remains below the 500-character limit
• git diff --check
• the earlier full local JVM run reached the existing PolarisArtworkDiskCacheTest boundary: three global eviction cases failed identically on exact origin/master; none of the changed files touch that cache path
• protected exact-head CI is required for 555d0190f8b25e6bd99edffb6bcc883593192823

Earlier signed RP6 evidence remains useful for the controller fix, but signer and physical acceptance must be repeated on the final exact candidate after this rebase.