address review: persist nightly checksums, guard the changelog, tidy CI

- write SHA256SUMS into the subtracks-nightly artifact
- assert at least one changelog exists in the metadata test
- drop the unused assembleDebug from the Forgejo CI
- only claim the AAB was uploaded to Play for stable releases
- clean up the export-certificate keystore with a trap

.github/workflows/release.yml

@@ -36,10 +36,10 @@ jobs:
           KEYSTORE_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_STORE_PASSWORD }}
         run: |
           umask 077
+          trap 'rm -f "$RUNNER_TEMP/keystore"' EXIT
           echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/keystore"
           alias=$(printf '%s' "$KEYPROPERTIES_BASE64" | base64 -d | sed -n 's/^keyAlias=//p' | tr -d '\r')
           nix develop --command keytool -exportcert -rfc -keystore "$RUNNER_TEMP/keystore" -alias "$alias" -storepass "$KEYSTORE_PASSWORD" -file app/build/outputs/release-certificate.pem
-          rm -f "$RUNNER_TEMP/keystore"
       - uses: actions/upload-artifact@v7
         with:
           name: release
@@ -112,7 +112,12 @@ jobs:
             echo
             echo "Signing certificate SHA-256: \`${{ steps.checksums.outputs.fingerprint }}\`"
             echo
-            echo 'The signing certificate is attached as `release-certificate.pem`. The `.aab` is the exact bundle uploaded to Google Play; the `.apk` is the universal APK for sideloading.'
+            echo 'The signing certificate is attached as `release-certificate.pem`.'
+            if [ "${{ steps.stable.outputs.value }}" = "true" ]; then
+              echo 'The `.aab` is the exact bundle uploaded to Google Play; the `.apk` is the universal APK for sideloading.'
+            else
+              echo 'The `.aab` is the built app bundle (this pre-release was not uploaded to Google Play); the `.apk` is the universal APK for sideloading.'
+            fi
           } > release-notes.md
       - name: Create GitHub release
         env: