ci(release): beta releases as Codeberg-only pre-releases (#369)

### What this changes

Adds beta releases, ported from Agendula (#38 and #40 there). Pushing a `release/*` branch whose `versionName` is `X.Y.Z-beta.N` runs the new `.gitea/workflows/beta.yaml`: unit tests, build + sign with the app key, then a **Codeberg pre-release** (APK + `.sha256`) and a Gitea pre-release (R8 mapping). F-Droid (self-hosted and official) and Play never get a beta; Obtainium only offers it with *Include prereleases* on.

- **New versionCode scheme**, derived in one place by `scripts/version_info.sh`. 2.22.3 is the last legacy version (`X*10000 + Y*100 + Z`); from **2.22.4** on it is `X*1000000 + Y*10000 + Z*100 + N` for a beta (N = 1–98) and `+ 99` for stable, so `2.22.4` → `2220499`, `2.23.0-beta.1` → `2230001`.
- **`scripts/release_gate.sh`** decides in both `detect` jobs whether the version still needs publishing. Tags are read by exact name via `git ls-remote`: Codeberg's `git/refs/tags/<name>` matches by prefix, so a beta tag would otherwise hide its stable release. A beta counts as done only once its Codeberg pre-release carries the APK (a failed publish is redone by the next push) and must be newer than the latest stable.
- **Shared scripts** `publish_codeberg_release.sh`, `publish_gitea_release.sh`, `release_notes.sh`, `write_keystore.sh`, and a local composite action `.gitea/actions/android-env` for the toolchain setup, used by both `release.yaml` and `beta.yaml`. The stable path behaves as before (Codeberg step stays best-effort).
- **Guards:** CI fails a PR whose `versionCode` doesn't match its `versionName`, or that brings a beta into `main`; `release.yaml` refuses a beta as a backstop; betas get no store What's New (`sync_changelog_to_fastlane.sh`, `check_changelog_lengths.sh`).
- **Docs:** versionCode table and "Cutting a beta" in `docs/RELEASING.md`, the Obtainium note in the README, `build.gradle.kts` comment.
- `gradle/gradle-daemon-jvm.properties` now points at JetBrains' own JBR 21.0.11 downloads instead of foojay, which dropped JetBrains 21 from its index (the pinned ids return 400, so a clean runner can't provision the daemon JVM).

### Why

To ship test builds of an upcoming version to opted-in testers before the stable release, without them reaching F-Droid or Play users.

Infra-only, so this targets `main` directly; no version bump. When cutting 2.22.4, its What's New file is `changelogs/2220499.txt`.

### Checklist

- [x] Targeting `main` (infra change, noted above)
- [x] No `values-*/strings.xml` touched
- [x] `CHANGELOG.md` not updated: release infrastructure, not a user-visible change
- [x] No planning or design documents committed

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/calendula/pulls/369

scripts/version_info.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Derives versionCode, channel and pre-release flag from the committed versionName.
+#
+#   X.Y.Z (<= 2.22.3)   stable   X*10000   + Y*100   + Z         (legacy)
+#   X.Y.Z-beta.N        beta     X*1000000 + Y*10000 + Z*100 + N   (N = 1..98)
+#   X.Y.Z (>= 2.22.4)   stable   X*1000000 + Y*10000 + Z*100 + 99
+#
+#   scripts/version_info.sh          all values as key=value lines
+#   scripts/version_info.sh <key>    one value
+#   scripts/version_info.sh --check  fail unless the committed versionCode matches
+#   scripts/version_info.sh --pin    rewrite the committed versionCode to the derived one
+set -euo pipefail
+cd "$(dirname "$0")/.."   # repo root
+
+GRADLE="app/build.gradle.kts"
+NAME=$(grep -oP 'versionName\s*=\s*"\K[^"]+' "$GRADLE" || true)
+COMMITTED=$(grep -oP 'versionCode\s*=\s*\K[0-9]+' "$GRADLE" || true)
+[ -n "$NAME" ] || { echo "No versionName in $GRADLE" >&2; exit 1; }
+
+if [[ ! "$NAME" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-beta\.([1-9][0-9]*))?$ ]]; then
+  echo "versionName '$NAME' is neither X.Y.Z nor X.Y.Z-beta.N" >&2
+  exit 1
+fi
+MAJOR=${BASH_REMATCH[1]}; MINOR=${BASH_REMATCH[2]}; PATCH=${BASH_REMATCH[3]}
+BETA=${BASH_REMATCH[5]}
+BASE="$MAJOR.$MINOR.$PATCH"
+
+if [ "$MINOR" -gt 99 ] || [ "$PATCH" -gt 99 ]; then
+  echo "versionName '$NAME': MINOR and PATCH each have room for 0-99" >&2
+  exit 1
+fi
+
+LEGACY=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
+if [ -n "$BETA" ]; then
+  if [ "$LEGACY" -lt 22204 ]; then
+    echo "versionName '$NAME': betas start at 2.22.4; legacy codes have no room for them" >&2
+    exit 1
+  fi
+  if [ "$BETA" -lt 1 ] || [ "$BETA" -gt 98 ]; then
+    echo "versionName '$NAME': beta number must be 1-98 (99 is the stable release)" >&2
+    exit 1
+  fi
+  CHANNEL=beta
+  CODE=$(( MAJOR * 1000000 + MINOR * 10000 + PATCH * 100 + BETA ))
+elif [ "$LEGACY" -lt 22204 ]; then
+  CHANNEL=stable
+  CODE=$LEGACY
+else
+  CHANNEL=stable
+  CODE=$(( MAJOR * 1000000 + MINOR * 10000 + PATCH * 100 + 99 ))
+fi
+
+if [ "$CHANNEL" = beta ]; then PRERELEASE=true; else PRERELEASE=false; fi
+
+case "${1:-}" in
+  "")
+    printf 'version=%s\nversion_code=%s\nbase_version=%s\nchannel=%s\nprerelease=%s\n' \
+      "$NAME" "$CODE" "$BASE" "$CHANNEL" "$PRERELEASE"
+    ;;
+  --check)
+    if [ "$COMMITTED" != "$CODE" ]; then
+      echo "ERROR: $GRADLE has versionCode = ${COMMITTED:-<none>}, but versionName '$NAME' needs $CODE." >&2
+      echo "Set versionCode = $CODE (see docs/RELEASING.md for the scheme)." >&2
+      exit 1
+    fi
+    echo "OK: versionName $NAME -> versionCode $CODE ($CHANNEL)."
+    ;;
+  --pin)
+    sed -i "s/versionCode = .*/versionCode = $CODE/" "$GRADLE"
+    grep -E 'versionName|versionCode' "$GRADLE"
+    ;;
+  version) echo "$NAME" ;;
+  version_code) echo "$CODE" ;;
+  base_version) echo "$BASE" ;;
+  channel) echo "$CHANNEL" ;;
+  prerelease) echo "$PRERELEASE" ;;
+  *) echo "Unknown key '$1'" >&2; exit 2 ;;
+esac