Document Android builds and add just helper

Provide a native Android build workflow and make it discoverable from the install docs.

- add docs/android-build.md with prerequisites (NDK r29, cargo-ndk, rust targets), build steps, output paths, and adb run example.

- add justfile android-build recipe that builds codex for arm64-v8a and x86_64 (API 26) into target/android.

- link the Android guide from docs/install.md.

docs/android-build.md

@@ -0,0 +1,53 @@
+# Android Native Build (codex)
+
+## Plan (Implemented)
+
+- Standardize TLS on `rustls` so Android builds do not depend on system OpenSSL.
+- Treat keyring storage as unsupported on Android and use file-backed storage instead.
+- Add a `just android-build` helper that uses `cargo-ndk` to build `codex` for `arm64-v8a` and `x86_64` (API 26).
+- Document build and run steps for pushing the binary to a device.
+
+## Prerequisites
+
+- Install [Android NDK](https://developer.android.com/studio/projects/install-ndk) r29 (recommended)
+    - set `ANDROID_NDK_HOME` accordingly, e.g.:
+```bash
+set export ANDROID_NDK_HOME=~/Library/Android/sdk/ndk/<version>/
+```
+
+- `cargo-ndk` (`cargo install cargo-ndk`).
+- Rust target: `rustup target add aarch64-linux-android`
+- Rust target: `rustup target add x86_64-linux-android`
+
+## Build
+
+From the repo root:
+
+```bash
+just android-build
+```
+
+If `cargo-ndk` cannot find your NDK, set:
+
+```bash
+export ANDROID_NDK_HOME="$HOME/Library/Android/sdk/ndk/<version>"
+```
+
+Build outputs:
+
+- `target/android/aarch64-linux-android/release/codex`
+- `target/android/x86_64-linux-android/release/codex`
+
+## Run On Device
+
+Example for `arm64-v8a`:
+
+```bash
+adb push target/android/aarch64-linux-android/release/codex /data/local/tmp/codex
+adb shell chmod +x /data/local/tmp/codex
+adb shell /data/local/tmp/codex --help
+```
+
+## Notes
+
+- On Android, keyring-backed credential storage is unavailable; Codex falls back to file-backed storage under `CODEX_HOME`.

docs/install.md

@@ -62,3 +62,7 @@ tail -F ~/.codex/log/codex-tui.log
 By comparison, the non-interactive mode (`codex exec`) defaults to `RUST_LOG=error`, but messages are printed inline, so there is no need to monitor a separate file.
 
 See the Rust documentation on [`RUST_LOG`](https://docs.rs/env_logger/latest/env_logger/#enabling-logging) for more information on the configuration options.
+
+## Android builds
+
+See `docs/android-build.md` for native Android build and `adb push` instructions (arm64-v8a and x86_64, API 26).

justfile

@@ -75,6 +75,10 @@ bazel-remote-test:
 build-for-release:
     bazel build //codex-rs/cli:release_binaries --config=remote
 
+# Build codex for Android (arm64-v8a and x86_64).
+android-build:
+    CARGO_TARGET_DIR=target/android cargo ndk --platform 26 -t arm64-v8a -t x86_64 build -p codex-cli --release --bin codex
+
 # Run the MCP server
 mcp-server-run *args:
     cargo run -p codex-mcp-server -- "$@"