release: only publish to Play for a stable tag

Gate the Play upload on a full vX.Y.Z tag and mark other tags as
prereleases. Fold the changelog length limit into MetadataConstraintsTest
and make its image checks reject anything but PNG or JPEG. Keep the
decoded keystore at 0600 and note in .forgejo/README.md that the GitHub
CI now factors the build into composite actions.

.github/workflows/release.yml

@@ -49,7 +49,16 @@ jobs:
           name: release
           path: dist
       - uses: ./.github/actions/nix
+      - name: Detect stable tag
+        id: stable
+        run: |
+          if [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "value=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Upload to Google Play
+        if: steps.stable.outputs.value == 'true'
         env:
           PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
         run: |
@@ -72,7 +81,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release create "$GITHUB_REF_NAME" subtracks.apk \
-            --verify-tag \
-            --title "$GITHUB_REF_NAME" \
-            --notes-file "metadata/en-US/changelogs/${{ needs.build.outputs.version-code }}.txt"
+          args=(--verify-tag --title "$GITHUB_REF_NAME" --notes-file "metadata/en-US/changelogs/${{ needs.build.outputs.version-code }}.txt")
+          if [ "${{ steps.stable.outputs.value }}" != "true" ]; then
+            args+=(--prerelease)
+          fi
+          gh release create "$GITHUB_REF_NAME" subtracks.apk "${args[@]}"