build(release): a Dart release tool for every app

tool/release.dart releases one app: `dart run tool/release.dart learn
[major | minor | patch] [--dry-run]`, each app configured in Dart beside
it (apps/learn/release.dart). Every step and check of tool/release.sh
is kept: the repository as pushed, resuming after a release commit and
tag, Flutter as CI pins it, the tools, the key and its certificate pin,
secrets asked for without echo and never written down, CI green on the
newest commit, the signed release commit and tag by a key deploys
accept, the APK built from a checkout of the tag and checked, the snap,
the signed checksums, pushing only after both builds passed, the
release on Forgejo, the F-Droid repository, the Snap Store once a
channel is set.

New: tags per app (learn-v0.19.0, Learn's v… counting as its
history); only commits touching the app decide its version (its folder,
the shared packages it uses by path, the root pubspec and lock, its
release files, where its packages were before the move); --dry-run
reads all of it, lists every step and the notes, and what a release
would refuse, changing nothing. The pure parts are tested in
test/release/. Learn releases build 21 with tool/release.sh, then
switches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/README.md

@@ -150,10 +150,13 @@ may choose another there, and keep accounts on several.
   release raises the build number: Android only installs a higher one over an older, and
   the server tells apps below the build it supports to update.
 - **Making one** is for maintainers, on their own machine and never in CI, from the
-  repository's root: `tool/release.sh`, or `tool/release.sh minor` (or `major`, `patch`)
-  to choose (until build 21 is out; then a release tool in Dart, shared by the apps,
-  takes over, [ADR 0015](../../docs/adr/0015-one-repository.md)). It needs `main` clean, pushed and green in CI, the app's key, the F-Droid repository's key and
-  a Forgejo token; its header says more. It shows the version and its commits and asks
+  repository's root: `dart run tool/release.dart learn`, or with `minor` (or `major`,
+  `patch`) after `learn` to choose; `--dry-run` shows what it would do and changes
+  nothing. It is the apps' shared release tool ([ADR 0015](../../docs/adr/0015-one-repository.md)),
+  configured in `apps/learn/release.dart`; build 21 alone still comes from
+  `tool/release.sh`. It needs `main` clean, pushed and green in CI, the app's key, the
+  F-Droid repository's key and a Forgejo token; its header says more. Tags are
+  `learn-vX.Y.Z`, and only commits touching Learn count for its version. It shows the version and its commits and asks
   first, then writes the version into the pubspec in a signed release commit with a
   signed tag, builds the APK and the snap (`snap/snapcraft.yaml`, built in LXD; its icon
   comes from `apps/learn/tool/app_icons.py`), checks both, signs the checksums, pushes, and