address review: guard the release pipeline and harden the metadata test

- fail the release before uploading to Play when the versionCode has no
  changelog
- rely on supply's defaults for release_status and metadata_path
- enforce 8-bit PNGs and reject tRNS chunks in MetadataConstraintsTest
- name the nightly artifact's APKs distinctly
- fix doc drift and the stale libraries uniqueId

.github/workflows/build-nightly.yml

@@ -20,9 +20,15 @@ jobs:
       - uses: ./.github/actions/build
         with:
           gradle-args: ":app:assembleDebug :app:assembleNightly --no-daemon"
+      - name: Collect
+        run: |
+          cp app/build/outputs/apk/debug/app-debug.apk subtracks-nightly-debug.apk
+          cp app/build/outputs/apk/nightly/app-nightly.apk subtracks-nightly.apk
       - name: Checksums
-        run: sha256sum app/build/outputs/apk/debug/app-debug.apk app/build/outputs/apk/nightly/app-nightly.apk
+        run: sha256sum subtracks-nightly.apk subtracks-nightly-debug.apk
       - uses: actions/upload-artifact@v7
         with:
           name: subtracks-nightly
-          path: app/build/outputs/apk
+          path: |
+            subtracks-nightly.apk
+            subtracks-nightly-debug.apk

.github/workflows/release.yml

@@ -68,6 +68,8 @@ jobs:
           else
             echo "value=false" >> "$GITHUB_OUTPUT"
           fi
+      - name: Check release notes exist
+        run: test -f "metadata/en-US/changelogs/${{ needs.build.outputs.version-code }}.txt"
       - name: Upload to Google Play
         if: steps.stable.outputs.value == 'true'
         env:
@@ -79,9 +81,7 @@ jobs:
             --aab dist/bundle/release/app-release.aab \
             --package_name com.subtracks \
             --track "${{ vars.PLAY_TRACK || 'internal' }}" \
-            --release_status completed \
             --json_key "$RUNNER_TEMP/play.json" \
-            --metadata_path metadata \
             --mapping dist/mapping/release/mapping.txt
       - name: Remove Play service account
         if: always()