build: releases fetch their signing keys from Proton Pass into memory, never onto the disk

tool/with_signing_keys.sh downloads the app's Android keystore and the
F-Droid index's from the vault Infra · Signing into a folder under
$XDG_RUNTIME_DIR, runs tool/release.dart with their paths, and removes
the folder however the run ends. The passwords are asked for as ever.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

test/release/signing_keys_test.dart

@@ -0,0 +1,41 @@
+import 'dart:io';
+
+import 'package:test/test.dart';
+
+import '../../tool/src/release/apps.dart';
+
+/// `tool/with_signing_keys.sh` fetches each app's keys from Proton Pass for a
+/// release: it must know every app released, by the item its key is kept in
+/// and the variable the release tool reads its path from.
+void main() {
+  // The test runs in the repository's root, as `dart test` does.
+  final script = File('tool/with_signing_keys.sh').readAsStringSync();
+
+  test('every app released has its key fetched, under the variable the '
+      'release tool reads, from the item named for it', () {
+    for (final app in releasedApps.values) {
+      expect(
+        script,
+        contains(
+          '  ${app.id}) app_variable=${app.android.keystoreVariable} '
+          "app_item='${app.name} – Android release keystore' ;;",
+        ),
+        reason: app.id,
+      );
+    }
+  });
+
+  test("the F-Droid index's key comes along for an app listed there", () {
+    expect(releasedApps.values.where((app) => app.fdroid != null), isNotEmpty);
+    expect(script, contains('HALKYON_FDROID_KEYSTORE='));
+    expect(
+      script,
+      contains("fdroid_item='Halkyon Learn – F-Droid index keystore'"),
+    );
+  });
+
+  test('the keys go to a folder in memory, removed however the run ends', () {
+    expect(script, contains(r'mktemp -d -p "$XDG_RUNTIME_DIR"'));
+    expect(script, contains("trap 'rm -rf \"\$keys\"' EXIT"));
+  });
+}