fix(ci): inspect the resource table, not zip paths, and self-check first

The previous guard reported "Drawables en el APK: (ninguno)" for a 105MB
release APK. Zero drawables is impossible -- AndroidX alone contributes
dozens -- so the check was wrong, not the build. Release APKs shorten and
rename resource file paths, so `res/drawable/...` simply is not how they
are stored there. The 45MB base.apk taken off the device kept readable
paths because it came from an AAB through bundletool; the CI builds a fat
APK through a different pipeline. Same app, different layout.

Resource NAMES survive in resources.arsc regardless of path shortening, so
that is what gets inspected now.

And the guard checks itself before judging. It looks for a sentinel
resource known to be present (station_art_nova); if the sentinel is not
found, the inspection method is unreliable and the step says so instead of
declaring anything absent. This guard has already lied once, reporting
ic_stat_pluriwave missing when it was verified present, and that lie was
about to send us hunting a build problem that did not exist. A check with
no way to detect its own failure has no business failing a build.

Verified before pushing, all three extracted verbatim from the parsed YAML
and run against real inputs:
  1. real 45MB base.apk    -> sentinel found, ic_stat_pluriwave OK,
                              ic_auto_eq_on/off missing, exit 1
  2. APK absent            -> reports the path and lists what is there,
                              exit 1, no resource accusations
  3. zip without arsc      -> "inspection impossible", exit 1 (checked
                              without a pipe, so the code is the script's)

Scenario 3 is the one the old guard got wrong: it turned an inspection
failure into three false "FALTA" lines.

.gitea/workflows/build.yml

@@ -163,14 +163,34 @@ jobs:
       # propias herramientas y vuelque el inventario real antes de juzgar.
       #
       # Anadir un drawable nuevo referenciado por nombre => anadirlo aqui.
+      # Guardian de recursos: el APK debe contener los drawables que el codigo
+      # resuelve POR NOMBRE en runtime (getResources().getIdentifier).
+      #
+      # Un nombre que no resuelve devuelve id 0. Eso no falla la compilacion:
+      # falla en el coche. PlaybackStateCompat.CustomAction.Builder lanza con
+      # icono 0, ese throw aborta AudioService.setState antes de activar la
+      # sesion de medios, y Android Auto se queda con la interfaz congelada.
+      # Paso exactamente eso desde el 31-07 (commit 2540556) sin deteccion.
+      #
+      # Se inspecciona resources.arsc, NO las rutas del zip: el APK release
+      # acorta/renombra las rutas de recursos (una version anterior de este
+      # paso listo "ningun drawable" en un APK de 105MB, que es imposible).
+      # Los NOMBRES de recurso siguen en la tabla pase lo que pase.
+      #
+      # El centinela existe porque este guardian ya mintio una vez: al no
+      # validar su propio metodo, reporto como ausente hasta un recurso que
+      # estaba verificado presente. Si el centinela no aparece, la inspeccion
+      # no es fiable y NO tenemos derecho a declarar nada ausente.
+      #
+      # Anadir un drawable nuevo referenciado por nombre => anadirlo aqui.
       - name: Verificar recursos criticos en el APK
         run: |
           set -u
           APK=build/app/outputs/flutter-apk/app-release.apk
+          CENTINELA=station_art_nova
 
           if [ ! -f "$APK" ]; then
             echo "El APK no esta donde se esperaba: $APK"
-            echo "Contenido de build/app/outputs:"
             find build/app/outputs -name '*.apk' 2>/dev/null || echo "  (nada)"
             exit 1
           fi
@@ -180,19 +200,25 @@ jobs:
             echo "unzip no esta disponible: no se puede inspeccionar el APK."
             exit 1
           fi
-          LISTADO=$(unzip -Z1 "$APK")
 
-          if [ -z "$LISTADO" ]; then
-            echo "El listado del APK salio vacio; la inspeccion no es fiable."
+          ARSC=$(mktemp)
+          unzip -p "$APK" resources.arsc > "$ARSC" 2>/dev/null || true
+          if [ ! -s "$ARSC" ]; then
+            echo "No se pudo extraer resources.arsc del APK."
             exit 1
           fi
+          echo "resources.arsc: $(wc -c < "$ARSC") bytes"
 
-          echo "Drawables en el APK:"
-          echo "$LISTADO" | grep "^res/drawable" || echo "  (ninguno)"
+          if ! grep -a -q "$CENTINELA" "$ARSC"; then
+            echo "El centinela '$CENTINELA' no aparece en la tabla de recursos."
+            echo "La inspeccion no es fiable; no se declara nada ausente."
+            exit 1
+          fi
+          echo "Centinela '$CENTINELA' localizado: la inspeccion es fiable."
 
           FALTAN=0
           for RECURSO in ic_auto_eq_on ic_auto_eq_off ic_stat_pluriwave; do
-            if echo "$LISTADO" | grep -qx "res/drawable/$RECURSO.xml"; then
+            if grep -a -q "$RECURSO" "$ARSC"; then
               echo "OK      $RECURSO"
             else
               echo "FALTA   $RECURSO"