ci: upload the nightly APKs as separate raw artifacts

archive: false only supports a single file, so upload each of the two
APKs and SHA256SUMS as its own unzipped artifact instead of one zip.

.github/workflows/ci.yml

@@ -35,11 +35,18 @@ jobs:
       - uses: actions/upload-artifact@v7
         if: github.ref == 'refs/heads/main'
         with:
-          name: subtracks-nightly
-          path: |
-            subtracks-nightly.apk
-            subtracks-nightly-debug.apk
-            SHA256SUMS
+          path: subtracks-nightly.apk
+          archive: false
+      - uses: actions/upload-artifact@v7
+        if: github.ref == 'refs/heads/main'
+        with:
+          path: subtracks-nightly-debug.apk
+          archive: false
+      - uses: actions/upload-artifact@v7
+        if: github.ref == 'refs/heads/main'
+        with:
+          path: SHA256SUMS
+          archive: false
       - uses: actions/cache@v6
         with:
           path: .integration/music

AGENTS.md

@@ -34,7 +34,7 @@ Everything comes from the Nix flake devshell; do not install toolchains by hand.
 
 ## CI
 
-- Forgejo Actions, `.forgejo/workflows/ci.yml`, a single `ci` job that runs lint, the unit tests, the debug and nightly assembles and the integration suite (one cache restore/save and Gradle warm-up instead of several); the GitHub copy uploads the debug and nightly APKs as the `subtracks-nightly` artifact on a push to `main`.
+- Forgejo Actions, `.forgejo/workflows/ci.yml`, a single `ci` job that runs lint, the unit tests, the debug and nightly assembles and the integration suite (one cache restore/save and Gradle warm-up instead of several); the GitHub copy uploads the debug and nightly APKs and the checksums as separate artifacts on a push to `main`.
 - Runs on the `nix-docker` runner (the `localhost/nix-ci` image built by the separate `nix-home` repo) inside the devshell, restoring the Nix store via `cache-nix-action` and caching Gradle and the integration test music.
 - The `nix-docker` and `bookworm` runner labels, their images and the runner's networking are defined in the separate `nix-home` repo (`hosts-incus/git-runner.nix`).
 - Pull requests from a fork need approval before the workflow runs.

signing/README.md

@@ -41,7 +41,7 @@ keytool -printcert -jarfile app-release.aab
 
 ## `nightly` builds
 
-The signing key is the committed [`app/debug.keystore`](../app/debug.keystore) (a public key: alias `androiddebugkey`, password `android`). The `subtracks-nightly` artifact contains `subtracks-nightly.apk` (minified) and `subtracks-nightly-debug.apk` (debuggable), both `com.subtracks.nightly`. Certificate SHA-256:
+The signing key is the committed [`app/debug.keystore`](../app/debug.keystore) (a public key: alias `androiddebugkey`, password `android`). The nightly build uploads `subtracks-nightly.apk` (minified) and `subtracks-nightly-debug.apk` (debuggable), both `com.subtracks.nightly`, as separate artifacts, along with `SHA256SUMS`. Certificate SHA-256:
 
 ```
 # keytool format