Fix release signing in CI: anchor plugin regex to buildTypes release block

The signing plugin added a release{} inside signingConfigs{}, so the debug-line
replacement matched that block instead of the release BUILD TYPE — CI produced
debug-signed APKs (would break Obtainium updates vs the release-signed v0.1.0).
Anchor on `buildTypes { ... release {`. Verified locally: release buildType now
uses the release key when BBP_UPLOAD_* is set. Also unify keystore path via
github.workspace in both steps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/build-apk.yml

@@ -38,7 +38,7 @@ jobs:
           sdkmanager "ndk;27.1.12297006" >/dev/null 2>&1 || true
 
       - name: Restore signing keystore
-        run: echo "${{ secrets.ANDROID_KEYSTORE_B64 }}" | base64 -d > "$GITHUB_WORKSPACE/app/release.keystore"
+        run: echo "${{ secrets.ANDROID_KEYSTORE_B64 }}" | base64 -d > "${{ github.workspace }}/app/release.keystore"
 
       - name: Expo prebuild (generate android/)
         working-directory: app