fix(release): F-Droid's upload resumable alone, by content, and Forgejo asked again

Train's first release (31 Oct 2026) stopped twice after its tag was pushed:

- Forgejo answered 500 (a unique constraint) to the release: it enters a
  pushed tag in its releases itself, a moment after the push. Asked again a
  few seconds later, it makes the release of that entry.
- The F-Droid upload filled the halkyon.app server's disk: rsync compared by
  time, and this laptop's working folder, restored from the repository, had
  every APK anew, so all 1.9 GB went again. It compares by content now.

tool/with_signing_keys.sh fdroid [APK] runs tool/fdroid_repo.sh alone with
the index's key, for an upload that failed after its release was made, and
the script skips an APK the working folder holds already rather than adding
a second file of the same build, which fdroid refuses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

test/release/signing_keys_test.dart

@@ -61,4 +61,16 @@ void main() {
     expect(script, contains(r'export HALKYON_FORGEJO_TOKEN="$token"'));
     expect(releaser, contains("variable: 'HALKYON_FORGEJO_TOKEN'"));
   });
+
+  test("fdroid runs the F-Droid repository's script alone, with the "
+      "index's key and its password only", () {
+    expect(script, contains('  fdroid) ;;'));
+    expect(script, contains(r'tool/fdroid_repo.sh "$@" || status=$?'));
+    final alone = script.substring(
+      script.indexOf(r'if [ "$app" = fdroid ]; then'),
+      script.indexOf(r'tool/fdroid_repo.sh "$@"'),
+    );
+    expect(alone, isNot(contains('app_item')));
+    expect(alone, isNot(contains('forgejo_token')));
+  });
 }