feat(release): the keystores' passwords from Proton Pass too, and F-Droid's tools checked first

tool/with_signing_keys.sh reads each keystore's password from its item's
hidden field "Password" and hands it to the release tool in its
environment (<keystore variable>_PASSWORD), but for a dry run, which asks
for no secret; the release tool takes a secret from there where it is
set, else asks as before (the Forgejo token from HALKYON_FORGEJO_TOKEN).
Typing them guarded nothing the Pass session didn't already open.

The release tool checks fdroid, rsync, curl and jq with the other tools,
so a dry run says when one is missing, rather than the F-Droid script
after the passwords.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

test/release/signing_keys_test.dart

@@ -38,4 +38,25 @@ void main() {
     expect(script, contains(r'mktemp -d -p "$XDG_RUNTIME_DIR"'));
     expect(script, contains("trap 'rm -rf \"\$keys\"' EXIT"));
   });
+
+  test("the keystores' passwords come from the items' field Password, "
+      'under the variables the release tool reads them from, but for a dry '
+      'run', () {
+    final releaser = File('tool/src/release/releaser.dart').readAsStringSync();
+    expect(script, contains('select(.name == "Password")'));
+    expect(
+      script,
+      contains(r'export "${app_variable}_PASSWORD=$app_password"'),
+    );
+    expect(
+      releaser,
+      contains(r"variable: '${app.android.keystoreVariable}_PASSWORD'"),
+    );
+    expect(
+      script,
+      contains(r'export HALKYON_FDROID_KEYSTORE_PASSWORD="$fdroid_password"'),
+    );
+    expect(releaser, contains("variable: 'HALKYON_FDROID_KEYSTORE_PASSWORD'"));
+    expect(script, contains(r'if ! $dry_run; then'));
+  });
 }