fix(compliance): disclose email collection in Play Data Safety + align privacy docs (#146)

* fix(compliance): disclose email collection in Play Data Safety + align privacy docs (closes #143)

Google Play rejected cc.agentlabs.opencode (2026-07-22) because the Data
Safety declaration did not disclose collection of Email Address. Root
cause: the optional "OpenCode Connect" waitlist card on the Connect
screen (app/connection/add.tsx -> src/lib/waitlist.ts) collects an email
and forwards it to Brevo (email marketing/CRM) via the beta-signup
backend.

Audited all other PII surfaces and confirmed no other undisclosed
collection: Chatwoot support reports stay anonymous (no email/name),
Sentry strips URLs/tokens and sends no default PII, and PostHog
analytics uses only a random anonymous ID with coarse event properties.

Updates:
- distribution/play-listing.md: Data Safety table now declares
  Personal info / Email address (collected, shared with Brevo,
  optional, purpose account management); embedded privacy-policy draft
  and app description updated to match.
- distribution/privacy-policy.md/.html + docs/privacy/index.html: new
  section 3c discloses the waitlist email collection, third-party
  services list adds Brevo, retention/rights sections and the Apple
  Privacy Nutrition Label table updated accordingly.
- docs/playstore.md: checklist entry documents the rejection and points
  to the fix.
- PUBLISHING.md: adds exact Play Console resubmission steps (Data
  types -> Personal info -> Email address -> collected/shared/purpose)
  plus a note on the earlier unrelated "Missing sign-in details" App
  access blocker in case it resurfaces.

No app code changed; npm test (209 pass) and tsc --noEmit are clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): run required checks on docs-only PRs (unblock branch protection)

ios-ci.yml (which emits the required 'Typecheck and unit tests' check) had
paths-ignore for docs/**, docs-site/**, distribution/**, **/*.md. A required
status check that is path-filtered never runs on docs-only PRs, so those PRs
sit permanently in mergeStateStatus=BLOCKED (missing required check). Remove the
paths-ignore so required checks always run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: test <test@test.local>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ios-ci.yml

@@ -10,21 +10,16 @@
 
 name: iOS CI
 
+# NOTE: no paths-ignore here. "Typecheck and unit tests" is a REQUIRED status
+# check in branch protection; a path-filtered required check never runs on
+# docs-only PRs, leaving them permanently BLOCKED. Running the cheap Linux
+# typecheck/test job (and the gated macOS build) on every PR keeps the required
+# check satisfiable. See #143 (docs PR stuck) for why.
 on:
   pull_request:
     branches: [main]
-    paths-ignore:
-      - "**/*.md"
-      - "docs/**"
-      - "docs-site/**"
-      - "distribution/**"
   push:
     branches: [main]
-    paths-ignore:
-      - "**/*.md"
-      - "docs/**"
-      - "docs-site/**"
-      - "distribution/**"
 
 # Cancel superseded runs for the same ref (e.g. new push to an open PR).
 concurrency: