address review: guard the release pipeline and harden the metadata test

- fail the release before uploading to Play when the versionCode has no
  changelog
- rely on supply's defaults for release_status and metadata_path
- enforce 8-bit PNGs and reject tRNS chunks in MetadataConstraintsTest
- name the nightly artifact's APKs distinctly
- fix doc drift and the stale libraries uniqueId

.github/workflows/release.yml

@@ -68,6 +68,8 @@ jobs:
           else
             echo "value=false" >> "$GITHUB_OUTPUT"
           fi
+      - name: Check release notes exist
+        run: test -f "metadata/en-US/changelogs/${{ needs.build.outputs.version-code }}.txt"
       - name: Upload to Google Play
         if: steps.stable.outputs.value == 'true'
         env:
@@ -79,9 +81,7 @@ jobs:
             --aab dist/bundle/release/app-release.aab \
             --package_name com.subtracks \
             --track "${{ vars.PLAY_TRACK || 'internal' }}" \
-            --release_status completed \
             --json_key "$RUNNER_TEMP/play.json" \
-            --metadata_path metadata \
             --mapping dist/mapping/release/mapping.txt
       - name: Remove Play service account
         if: always()