ci: fail the build when a changelog will not fit F-Droid

`sync_changelog_to_fastlane.sh` has been printing "note: >500 chars — F-Droid
may truncate this changelog in-client" for three releases, and every release
since 0.2.0 has sailed past it: 1824, 696, 916 characters. A note nobody acts
on is not a check.

F-Droid truncates the in-client "What's New" box, so everything past the limit
is written for nobody — the reader gets a sentence cut mid-word and no way to
expand it. The limit is now a hard failure: the script exits non-zero, with a
message naming the section to shorten, and `MAX_CHARS` is a variable so the
bound lives in one place rather than being copied into the workflows.

Enforced in two places, for two different failures:

- `.forgejo/workflows/ci.yaml` runs it as an always-on guard beside the
  reproducible-release invariant, then checks `git status --porcelain` over the
  changelogs directory. That second half catches a CHANGELOG.md edit whose
  generated fastlane file was never committed — which until now degraded
  silently into the official F-Droid listing showing the *previous* version's
  notes, exactly as RELEASING.md step 3 warns. Porcelain rather than
  `git diff --exit-code`, so a brand-new file for a bumped versionCode counts
  as dirty instead of being missed as untracked.
- `.gitea/workflows/release.yaml` gets the same call in the cheap `detect`
  gate. The release job already regenerated the file, but only at step 15 of
  24 — after the build, the signing and the keystore setup. Failing in `detect`
  costs one bash invocation and publishes nothing.

.forgejo/workflows/ci.yaml

@@ -37,6 +37,26 @@ jobs:
       - name: Reproducible-release invariant
         run: bash scripts/check_reproducible_release.sh
 
+      # Also cheap, also always-on. Two failures in one: the script exits
+      # non-zero if this version's changelog is over the character limit
+      # F-Droid truncates at, and the porcelain check below catches a
+      # CHANGELOG.md edit whose generated fastlane file was never committed —
+      # which used to degrade silently into "the official listing shows the
+      # previous version's notes".
+      - name: Changelog fits F-Droid, and is committed
+        run: |
+          set -e
+          bash scripts/sync_changelog_to_fastlane.sh
+          DIRTY=$(git status --porcelain fastlane/metadata/android/en-US/changelogs)
+          if [ -n "$DIRTY" ]; then
+            echo "$DIRTY"
+            echo "ERROR: the generated fastlane changelog is not what is committed." >&2
+            echo "Run scripts/sync_changelog_to_fastlane.sh and commit the result, so" >&2
+            echo "the official F-Droid listing shows this version's notes rather than" >&2
+            echo "the previous one's." >&2
+            exit 1
+          fi
+
       # Decide whether anything that affects the app build changed. Docs, store
       # metadata, licence texts and forge housekeeping don't, so those PRs skip
       # the SDK + Gradle work below but still report a green `ci`.