fix(release): F-Droid's upload resumable alone, by content, and Forgejo asked again

Train's first release (31 Oct 2026) stopped twice after its tag was pushed:

- Forgejo answered 500 (a unique constraint) to the release: it enters a
  pushed tag in its releases itself, a moment after the push. Asked again a
  few seconds later, it makes the release of that entry.
- The F-Droid upload filled the halkyon.app server's disk: rsync compared by
  time, and this laptop's working folder, restored from the repository, had
  every APK anew, so all 1.9 GB went again. It compares by content now.

tool/with_signing_keys.sh fdroid [APK] runs tool/fdroid_repo.sh alone with
the index's key, for an upload that failed after its release was made, and
the script skips an APK the working folder holds already rather than adding
a second file of the same build, which fdroid refuses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

tool/fdroid_repo.sh

@@ -134,7 +134,15 @@ for icon in app.halkyon.learn:snap/gui/halkyon-learn.png \
 done
 if [ -n "$apk" ]; then
   [ -f "$apk" ] || fail "No APK at $apk."
-  cp "$apk" "$working/repo/"
+  # Once in the working folder (an earlier run whose upload failed), the same APK
+  # again would be a second file of the same build, which fdroid refuses.
+  apk_hash=$(sha256sum "$apk" | cut -d' ' -f1)
+  if sha256sum "$working"/repo/*.apk "$working"/archive/*.apk 2>/dev/null |
+    grep -q "^$apk_hash "; then
+    echo "  $(basename "$apk") is in the repository already"
+  else
+    cp "$apk" "$working/repo/"
+  fi
 fi
 # Names every APK as F-Droid does (<app id>_<version code>.apk) and signs the
 # indexes with the repository's key.
@@ -142,15 +150,17 @@ fi
 
 step "Uploading it to $upload_host"
 # The APKs and icons first, the indexes last, so the F-Droid app never reads an
-# index naming a file that isn't there yet.
+# index naming a file that isn't there yet. By their contents (--checksum), not their
+# times: a working folder restored on another laptop has every APK with a new time,
+# and would send them all again (1.9 GB in October 2026, on a disk with less free).
 for dir in repo archive; do
   [ -d "$working/$dir" ] || continue
-  rsync -a --chmod=D755,F644 --exclude='index*' --exclude='entry.*' \
+  rsync -a --checksum --chmod=D755,F644 --exclude='index*' --exclude='entry.*' \
     "$working/$dir/" "$upload_host:$dir/"
 done
 for dir in repo archive; do
   [ -d "$working/$dir" ] || continue
-  rsync -a --chmod=D755,F644 --delete-after "$working/$dir/" "$upload_host:$dir/"
+  rsync -a --checksum --chmod=D755,F644 --delete-after "$working/$dir/" "$upload_host:$dir/"
 done
 
 echo "  $repo_url?fingerprint=$fingerprint"