docs(qa-261): ajoute documents conformité et scripts QA pour release Android

- Ajoute privacy-policy-v1.md et release-compliance-checklist.md
- Ajoute documents QA gates #238-#243
- Ajoute scripts de validation repo-only et device runbooks
- Prépare checklists exécutables avant upload Play fermé

Ticket #261

docs/release-compliance-checklist.md

@@ -0,0 +1,73 @@
+# GameTime Release and Compliance Checklist
+
+This checklist tracks the repo-owned release/compliance work that can be closed
+without Play Console access or physical devices.
+
+## Privacy Policy
+
+- Canonical repo draft: `docs/legal/privacy-policy-v1.md`
+- Version: `1.0`
+- Effective date: `2026-08-22`
+- Before Play submission, publish the exact approved policy at a stable HTTPS
+  URL and enter that URL in Play Console.
+- Keep future policy changes versioned in `docs/legal/`.
+
+## Product Entitlements
+
+The release surface must preserve these product invariants:
+
+- sharing is free
+- Free limits the editable workout library, not basic workout execution
+- imported/shared resources count against the receiver quota on acceptance
+- Pro means unlimited library plus sync
+- Wear OS companion is free
+- Health Connect is free
+
+## Android Network Policy
+
+Phone app release builds:
+
+- keep `android.permission.INTERNET` in `android/app/src/main/AndroidManifest.xml`
+- do not enable `android:usesCleartextTraffic` in the main manifest
+- use HTTPS for `GAMETIME_API_BASE_URL` in release builds
+
+Phone app debug/profile builds:
+
+- may keep cleartext enabled through the debug/profile manifest overlays
+- may use LAN HTTP URLs for local API development
+
+Wear OS companion:
+
+- keep release cleartext disabled
+- keep companion functionality free and independent from Pro entitlement
+
+## Repo-Only Validation
+
+Run these checks before handing off to Play/device validation:
+
+```bash
+rg -n 'usesCleartextTraffic="true"' android/app/src/main watch_app/android/app/src/main
+rg -n 'usesCleartextTraffic="true"' android/app/src/debug android/app/src/profile
+rg -n 'android.permission.INTERNET' android/app/src/main/AndroidManifest.xml
+rg -n 'Health Connect|Wear OS|sharing is free|Pro means unlimited' docs/legal docs
+```
+
+Expected result:
+
+- no `usesCleartextTraffic="true"` in release/main manifests
+- debug/profile overlays explicitly allow local cleartext
+- phone release manifest still declares `INTERNET`
+- privacy and release docs preserve the Free/Pro invariants
+
+## External Blockers
+
+These items cannot be closed from the repository alone:
+
+- Play Console app content forms
+- public privacy-policy hosting URL
+- production support/contact address approval
+- Play Health Connect declaration/review, if required by the final release track
+- validation on a real Android phone
+- validation on a real Wear OS device
+- production HTTPS endpoint and certificate verification
+