build(train): Train is released as Learn is, with a key of its own, beside it in the F-Droid repository (ADR 0030, D58)

apps/train/release.dart configures the release tool for Train's APK on
train.halkyon.eu; its release builds sign with its own key when the tool
hands it over. Its F-Droid listing declares NonFreeDep for Polar's SDK and
NonFreeNet; the repository's script copies each app's icon. The key's
certificate is pinned once the key is made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0030-halkyon-train.md

@@ -1447,6 +1447,16 @@ Strava. What was found, 27 Oct:
   when they are written; a reset of the account's keys (ADR 0017) renames every row,
   as it leaves what was sealed unreadable anyway. Train had no release, so no row
   needed moving.
+- **D58 Train's releases** (recommended, the developer's; 30 Oct): as Learn's, from
+  `tool/release.dart train` on the developer's laptop (`apps/train/release.dart`), the
+  APK alone (Train is Android's), connecting to train.halkyon.eu, published on
+  code.halkyon.app and in the project's F-Droid repository beside Learn, signed with a
+  key of Train's own (a PKCS #12 keystore at `~/.local/share/halkyon-train/`, its
+  certificate pinned in `tool/release/train-android-certificate.sha256`): one key for
+  both apps would let either's build pass for the other's update. Its listing
+  (`tool/release/fdroid/metadata/app.halkyon.train.yml`) declares `NonFreeDep` (Polar's
+  SDK, D36) and `NonFreeNet` (Polar's firmware service, the direct way of D40, and the
+  server's SSPL, as Learn's says).
 
 ## Consequences