scripts: --new-keystore, and say when a password is refused for not being ASCII

[cryptskii]

Java's PKCS12 keystores accept only ASCII passwords, and the two ways a password reaches them disagree on anything else:

• keytool's own prompt decodes the terminal by its locale, so a character such as € or § can arrive as ?. The keystore is then created, and it opens at that prompt.
• The deploy script reads the same password and passes it to keytool and Gradle intact, through the environment. The keystore refuses it with "keystore password was incorrect". Creating a keystore through the environment fails outright with "Password is not ASCII".

Both behaviours were reproduced with the JDK in this environment.

Changes to scripts/fast_deploy_android_release.sh:

• --new-keystore creates the signing keystore from the script's own prompt, the same channel every later build reads the password from:
  • the password is asked for twice and must be ASCII (symbols such as !@#$%^&* are fine);
  • the old keystore is kept as <path>.<time>.bak, or put back if keytool fails.
• A refused password that contains a non-ASCII character now gets a message saying so and pointing to --new-keystore, instead of another prompt.

Tested on a real TTY (via script):

• At creation, a non-ASCII password is refused, a mismatched repeat is refused, and an ASCII password with symbols creates the keystore and builds.
• A later run with the right password opens the keystore.
• A keystore made at keytool's prompt with a € is refused with the explanation.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y4wDTToHmJfkYYJvMKXt3u

---

Generated by Claude Code