ci: fail the build when a changelog will not fit F-Droid

`sync_changelog_to_fastlane.sh` has been printing "note: >500 chars — F-Droid
may truncate this changelog in-client" for three releases, and every release
since 0.2.0 has sailed past it: 1824, 696, 916 characters. A note nobody acts
on is not a check.

F-Droid truncates the in-client "What's New" box, so everything past the limit
is written for nobody — the reader gets a sentence cut mid-word and no way to
expand it. The limit is now a hard failure: the script exits non-zero, with a
message naming the section to shorten, and `MAX_CHARS` is a variable so the
bound lives in one place rather than being copied into the workflows.

Enforced in two places, for two different failures:

- `.forgejo/workflows/ci.yaml` runs it as an always-on guard beside the
  reproducible-release invariant, then checks `git status --porcelain` over the
  changelogs directory. That second half catches a CHANGELOG.md edit whose
  generated fastlane file was never committed — which until now degraded
  silently into the official F-Droid listing showing the *previous* version's
  notes, exactly as RELEASING.md step 3 warns. Porcelain rather than
  `git diff --exit-code`, so a brand-new file for a bumped versionCode counts
  as dirty instead of being missed as untracked.
- `.gitea/workflows/release.yaml` gets the same call in the cheap `detect`
  gate. The release job already regenerated the file, but only at step 15 of
  24 — after the build, the signing and the keystore setup. Failing in `detect`
  costs one bash invocation and publishes nothing.

scripts/sync_changelog_to_fastlane.sh

@@ -20,6 +20,10 @@ MAJOR=${VERSION%%.*}; rest=${VERSION#*.}; MINOR=${rest%%.*}; PATCH=${rest##*.}
 MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}
 VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
 
+# F-Droid's in-client changelog box truncates past roughly this length; CI reads
+# this value rather than hardcoding its own copy.
+MAX_CHARS=${MAX_CHARS:-500}
+
 CL_DIR="fastlane/metadata/android/en-US/changelogs"
 mkdir -p "$CL_DIR"
 OUT="$CL_DIR/${VERSION_CODE}.txt"
@@ -36,6 +40,21 @@ fi
 
 CHARS=$(wc -m < "$OUT" | tr -d ' ')
 echo "Wrote $OUT (version $VERSION, code $VERSION_CODE, ${CHARS} chars)"
-if [ "$CHARS" -gt 500 ]; then
-  echo "  note: >500 chars — F-Droid may truncate this changelog in-client." >&2
+
+# Hard limit, not a note. F-Droid truncates the "What's New" box in-client, so
+# anything past this is written for nobody: the reader sees a sentence cut
+# mid-word and no way to expand it. Keep the section in CHANGELOG.md short
+# enough to survive that, and put the detail in the commit messages and docs,
+# where there is room for it.
+#
+# CI enforces the same bound (.forgejo/workflows/ci.yaml) so a release cannot
+# reach main with a changelog its users cannot read.
+if [ "$CHARS" -gt "$MAX_CHARS" ]; then
+  cat >&2 <<MSG
+ERROR: $OUT is $CHARS characters, over the $MAX_CHARS-character limit.
+
+F-Droid truncates the in-client changelog, so this one would be cut off
+mid-sentence. Shorten the "## [$VERSION]" section in CHANGELOG.md and re-run.
+MSG
+  exit 1
 fi