ci: share the build and isolate the release credentials

Extract checkout, nix, signing and the Gradle run into a reusable build
workflow used by CI, the next build and the release build job. The build
job holds only the signing secrets; the publish job is the only one with
a write token and the Play credential. The Play service account is now
written to a 0600 file and passed via --json_key instead of on argv.

.github/workflows/ci.yml

@@ -9,22 +9,26 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  GRADLE_OPTS: -Dorg.gradle.daemon=false
-  NIX_CONFIG: experimental-features = nix-command flakes
-
-defaults:
-  run:
-    shell: sh
-
 jobs:
-  ci:
+  build:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build.yml
+    with:
+      gradle-args: ":app:ktlintCheck :app:lintDebug :app:testDebugUnitTest --no-configuration-cache --console=plain --no-daemon"
+
+  integration:
     runs-on: ubuntu-26.04
     timeout-minutes: 90
     permissions:
       contents: read
+    env:
+      GRADLE_OPTS: -Dorg.gradle.daemon=false
+      NIX_CONFIG: experimental-features = nix-command flakes
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
       - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
         with:
@@ -33,13 +37,11 @@ jobs:
           gc-max-store-size-linux: 6G
       - uses: actions/cache@v6
         with:
-          path: |
-            ~/.gradle/caches
+          path: ~/.gradle/caches
           key: gradle-${{ hashFiles('**/*.gradle*', '**/gradle.properties', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
           restore-keys: gradle-
       - uses: actions/cache@v6
         with:
           path: .integration/music
           key: integration-music-v1
-      - run: nix develop --command gradle :app:ktlintCheck :app:lintDebug :app:testDebugUnitTest --no-configuration-cache --console=plain
       - run: nix develop .#integration --command nu tools/integration-test.nu