fix: isolate container SDK configuration

docs/reproducible-builds.md

@@ -28,7 +28,8 @@ The build uses a clean source tree, an isolated Gradle user home, UTC, a stable
 locale, `SOURCE_DATE_EPOCH` from the Git commit, no Gradle build or configuration
 cache, fresh tasks, and a non-incremental in-process Kotlin compiler. Native
 builds remap source paths and release validation rejects host paths in packaged
-libraries.
+libraries. The container overlays a canonical `local.properties`, so an ignored
+Android Studio file cannot redirect Gradle to a host-specific SDK.
 
 AGP's embedded VCS record is disabled because its Git discovery depends on the
 host checkout layout. The canonical `BUILDINFO.json` and GitHub provenance

tools/reproducible-builds/build-in-container.sh

@@ -7,11 +7,16 @@ PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 IMAGE_NAME="bitchat-android-reproducible-builder:21.0.11"
 OUTPUT_DIR="${1:-$PROJECT_ROOT/.reproducible-build/release}"
 GRADLE_HOME_NAME="${BITCHAT_CONTAINER_GRADLE_HOME_NAME:-gradle-home-container}"
+CONTAINER_LOCAL_PROPERTIES="$SCRIPT_DIR/container-local.properties"
 
 if ! command -v docker >/dev/null 2>&1; then
   echo "error: Docker is required for the canonical container build" >&2
   exit 1
 fi
+if [ ! -f "$CONTAINER_LOCAL_PROPERTIES" ]; then
+  echo "error: missing canonical container local.properties" >&2
+  exit 1
+fi
 
 if [ "${BITCHAT_ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git -C "$PROJECT_ROOT" status --porcelain --untracked-files=normal)" ]; then
   echo "error: reproducible builds require a clean source tree" >&2
@@ -58,6 +63,7 @@ docker run \
   --env HOME=/workspace/.reproducible-build \
   --env SOURCE_DATE_EPOCH="$source_date_epoch" \
   --volume "$PROJECT_ROOT:/workspace" \
+  --mount "type=bind,source=$CONTAINER_LOCAL_PROPERTIES,target=/workspace/local.properties,readonly" \
   "${output_mount[@]}" \
   "$IMAGE_NAME" \
   "$container_output"

tools/reproducible-builds/container-local.properties

@@ -0,0 +1 @@
+sdk.dir=/opt/android-sdk