release: publish signed builds on v* tags

Set applicationId to com.subtracks and add a GitHub Actions workflow
that, on a v* tag, builds and signs the release APK and AAB, creates
the GitHub release with the APK, and uploads the AAB to Google Play.
Release notes come from the matching metadata changelog.

Signing reads the keystore from the environment
(RELEASE_KEYSTORE, RELEASE_KEYSTORE_PASSWORD, RELEASE_KEY_ALIAS,
RELEASE_KEY_PASSWORD) and falls back to the debug key locally.

app/build.gradle.kts

@@ -20,7 +20,7 @@ android {
     buildToolsVersion = "37.0.0"
 
     defaultConfig {
-        applicationId = "com.subtracks.next"
+        applicationId = "com.subtracks"
         minSdk = 24
         targetSdk = 37
         versionCode = 13
@@ -79,13 +79,25 @@ android {
         .kotlin.directories
         .add("src/integrationTest/kotlin")
 
+    signingConfigs {
+        val keystorePath = providers.environmentVariable("RELEASE_KEYSTORE").orNull
+        if (keystorePath != null) {
+            create("release") {
+                storeFile = file(keystorePath)
+                storePassword = providers.environmentVariable("RELEASE_KEYSTORE_PASSWORD").orNull
+                keyAlias = providers.environmentVariable("RELEASE_KEY_ALIAS").orNull
+                keyPassword = providers.environmentVariable("RELEASE_KEY_PASSWORD").orNull
+            }
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"))
-            // Debug key so `installRelease` works locally; store and F-Droid builds re-sign.
-            signingConfig = signingConfigs.getByName("debug")
+            // Release signing when the keystore is supplied (CI); debug elsewhere so local build/install works.
+            signingConfig = signingConfigs.findByName("release") ?: signingConfigs.getByName("debug")
         }
     }
 }