Pass release secrets via env vars, not inline YAML interpolation

Splicing multi-line secrets directly into a run: script via
\${{ secrets.X }} can mangle the bytes; env vars preserve them
exactly. Also adds a sanity check that the decoded keystore is a
binary file, not corrupted text, to fail fast with a clear error
next time instead of a cryptic ASN.1 exception.

Author: roman-gmk

.github/workflows/release.yml

@@ -25,14 +25,24 @@ jobs:
         uses: android-actions/setup-android@v3
 
       - name: Decode keystore
-        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > release.jks
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+        run: |
+          echo "$KEYSTORE_BASE64" | base64 -d > release.jks
+          # Sanity check: a valid PKCS12/JKS keystore is a binary file, never plain text.
+          file release.jks
+          test -s release.jks
 
       - name: Write key.properties
+        env:
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
         run: |
           cat > key.properties <<EOF
-          storePassword=${{ secrets.KEYSTORE_PASSWORD }}
-          keyPassword=${{ secrets.KEY_PASSWORD }}
-          keyAlias=${{ secrets.KEY_ALIAS }}
+          storePassword=$KEYSTORE_PASSWORD
+          keyPassword=$KEY_PASSWORD
+          keyAlias=$KEY_ALIAS
           storeFile=../release.jks
           EOF