fix(metrics): repair review triage — correct secret wiring, privacy-safe aggregated issues. Closes #61. Refs #60. (#78)

* fix(metrics): repair review triage — correct secret wiring, privacy-safe aggregated issues

- triage-reviews.yml read secrets.GOOGLE_SERVICE_ACCOUNT_JSON, which doesn't
  exist; map the real PLAY_STORE_SERVICE_ACCOUNT_JSON secret onto the env var
  the script expects.
- triage-reviews.py rewritten to maintain a single sanitized, deduped
  "Play Store Review Triage" issue instead of one public issue per review.
  The old version leaked reviewer full names and verbatim review text into
  public GitHub issues and spammed the tracker. The new version aggregates
  actionable (<=3 star) reviews into one issue with rating counts, a
  word-frequency theme summary (no quoted sentences), and opaque review_id
  references for Play Console lookup. An embedded HTML comment marker
  (matching the product-intelligence.mjs pattern) holds the current
  actionable review_id set so runs update in place and skip entirely when
  nothing changed.
- product-intelligence.yml referenced the nonexistent
  SENTRY_PRODUCT_INTELLIGENCE_TOKEN secret, causing the daily cron to fail
  silently (#60). Fall back to SENTRY_AUTH_TOKEN when the dedicated
  read-only token isn't configured.
- docs/playstore.md: document that Play Console is still the only trusted
  source for acquisition/uninstall metrics (product-intelligence.mjs defers
  this), and that review-based signals are sourced via the Android
  Publisher API through PLAY_STORE_SERVICE_ACCOUNT_JSON.

Closes #61. Refs #60.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NJKAQ6HAikWGQK7PGZ5Y4E

* fix(triage): fail visibly when GOOGLE_SERVICE_ACCOUNT_JSON is missing

Review finding on PR #78: env_client() exited 0 on missing credentials,
so the scheduled workflow would report success while silently doing
nothing — contradicting issue #61's 'missing credentials fail visibly'
done-criteria.

---------

Co-authored-by: engineer <engineer@gray-knight-m1.local>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs/playstore.md

@@ -97,6 +97,27 @@ After 14 days on Closed testing with 12+ active testers → promote to Productio
 
 ---
 
+## Acquisition metrics — trusted source
+
+There is currently no verified, least-privilege source wired up for Play
+Store acquisition/uninstall metrics (installs, uninstalls, store listing
+conversion). `scripts/product-intelligence.mjs` explicitly lists this as a
+**deferred** metric until a proper reporting contract exists — do not treat
+ad-hoc Play Console screenshots or manual exports as a trusted feed for
+automated reporting.
+
+Until that's implemented, the Play Console UI
+(https://play.google.com/console/u/2/developers/8842655543970815326) is the
+only source of truth for acquisition numbers, checked manually. Review
+volume/rating triage (a related but separate signal) is automated via
+`.github/workflows/triage-reviews.yml` + `scripts/triage-reviews.py`, which
+reads reviews through the Android Publisher API using the
+`PLAY_STORE_SERVICE_ACCOUNT_JSON` GitHub secret (see "Linked GCP resources"
+above) — this is the trusted source for review-based signals, not any
+scraped or manually copied review text.
+
+---
+
 ## Sibling channels: F-Droid + IzzyOnDroid
 
 OpenCode Mobile is also distributed via F-Droid (mainline) and IzzyOnDroid —