address review: persist nightly checksums, guard the changelog, tidy CI

- write SHA256SUMS into the subtracks-nightly artifact
- assert at least one changelog exists in the metadata test
- drop the unused assembleDebug from the Forgejo CI
- only claim the AAB was uploaded to Play for stable releases
- clean up the export-certificate keystore with a trap

app/src/test/kotlin/com/subtracks/metadata/MetadataConstraintsTest.kt

@@ -45,11 +45,9 @@ class MetadataConstraintsTest {
     @Test
     fun changelogsFitStoreLimit() {
         localeFiles("changelogs").forEach { dir ->
-            dir
-                .listFiles()
-                .orEmpty()
-                .filter { it.isFile && it.extension == "txt" }
-                .forEach { assertAtMost(it, CHANGELOG_LIMIT) }
+            val changelogs = dir.listFiles().orEmpty().filter { it.isFile && it.extension == "txt" }
+            assertTrue("no changelogs found in ${dir.path}", changelogs.isNotEmpty())
+            changelogs.forEach { assertAtMost(it, CHANGELOG_LIMIT) }
         }
     }