Fix release signing in CI: anchor plugin regex to buildTypes release block

The signing plugin added a release{} inside signingConfigs{}, so the debug-line
replacement matched that block instead of the release BUILD TYPE — CI produced
debug-signed APKs (would break Obtainium updates vs the release-signed v0.1.0).
Anchor on `buildTypes { ... release {`. Verified locally: release buildType now
uses the release key when BBP_UPLOAD_* is set. Also unify keystore path via
github.workspace in both steps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/build-apk.yml

@@ -38,7 +38,7 @@ jobs:
           sdkmanager "ndk;27.1.12297006" >/dev/null 2>&1 || true
 
       - name: Restore signing keystore
-        run: echo "${{ secrets.ANDROID_KEYSTORE_B64 }}" | base64 -d > "$GITHUB_WORKSPACE/app/release.keystore"
+        run: echo "${{ secrets.ANDROID_KEYSTORE_B64 }}" | base64 -d > "${{ github.workspace }}/app/release.keystore"
 
       - name: Expo prebuild (generate android/)
         working-directory: app

app/plugins/withReleaseSigning.js

@@ -34,10 +34,11 @@ module.exports = function withReleaseSigning(config) {
         `signingConfigs {${SIGNING_BLOCK}`,
       );
       // 2) Point the release buildType at the release key when its env is set, else
-      //    debug. Replace the RN template's unconditional debug line inside the
-      //    release {} block (otherwise it overrides the release config).
+      //    debug. Anchor on `buildTypes { … release {` so we hit the release
+      //    BUILD TYPE's debug line — not the `release {}` we just added inside
+      //    signingConfigs {} (which would leave release builds on the debug key).
       gradle = gradle.replace(
-        /(release \{[\s\S]*?)signingConfig signingConfigs\.debug/,
+        /(buildTypes \{[\s\S]*?release \{[\s\S]*?)signingConfig signingConfigs\.debug/,
         `$1signingConfig System.getenv("BBP_UPLOAD_STORE_FILE") != null ? signingConfigs.release : signingConfigs.debug`,
       );
     }