fix(ci): don't use bash-only syntax in the APK workflow

The runner hands `run:` blocks to sh (dash), where `${GITHUB_SHA::8}` is
not substring expansion but a syntax error. It failed as

    /var/run/act/workflow/9.sh: 29: Bad substitution

which names a temp file and no line of the workflow, after a 51-minute
build that had already produced a correctly signed APK and only needed to
write a summary table.

Two changes, either of which would have been enough, because this is a
silly way to lose an hour:

- The job declares `shell: bash`, so the rest of the file's assumptions
  hold and a future bash-ism does not resurface this.
- The short SHA is computed once with `cut` in the resolve step and read
  as a step output, so the two places that wanted it no longer depend on
  which shell runs them at all.

Everything before this point is confirmed working from the same run: the
SDK is found, the Rust cross-compile completes, gradle mints a debug
keystore, R8 runs, and apksigner reports "CN=Android Debug" -- the
side-by-side signing this workflow is supposed to produce.

.gitea/workflows/build-test-apk.yml

@@ -77,6 +77,13 @@ jobs:
   build:
     name: Build test APK
     runs-on: linux/amd64
+    defaults:
+      run:
+        # This runner executes `run:` blocks with `sh` (dash) unless told
+        # otherwise, so bash-only syntax fails with a bare "Bad substitution"
+        # naming a temp file and no line of your workflow. Say bash explicitly.
+        # The short-SHA output below avoids depending on it regardless.
+        shell: bash
     container:
       image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08.1
     env:
@@ -135,6 +142,12 @@ jobs:
           # Stable asset name for the same reason the tag is stable.
           ASSET="jellytau-${TAG}.apk"
 
+          # Computed once, with `cut` rather than `${GITHUB_SHA::8}`. The
+          # substring form is bash-only and this runner may hand a step to
+          # `sh`; that cost a 51-minute build which produced a perfectly good
+          # APK and then died formatting the summary table.
+          SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-8)
+
           {
             echo "variant=$VARIANT"
             echo "abi=$ABI"
@@ -143,6 +156,7 @@ jobs:
             echo "release_name=$RELEASE_NAME"
             echo "asset=$ASSET"
             echo "branch=$BRANCH"
+            echo "short_sha=$SHORT_SHA"
           } >> "$GITHUB_OUTPUT"
 
           echo "variant=$VARIANT abi=$ABI publish=$PUBLISH tag=$TAG asset=$ASSET"
@@ -232,7 +246,7 @@ jobs:
             echo "| | |"
             echo "|---|---|"
             echo "| Branch | \`${{ steps.cfg.outputs.branch }}\` |"
-            echo "| Commit | \`${GITHUB_SHA::8}\` |"
+            echo "| Commit | \`${{ steps.cfg.outputs.short_sha }}\` |"
             echo "| Variant | \`${{ steps.cfg.outputs.variant }}\` |"
             echo "| ABI | \`${{ steps.cfg.outputs.abi }}\` |"
             echo "| Size | $(du -h "$OUT" | cut -f1) |"
@@ -266,7 +280,7 @@ jobs:
           ASSET="${{ steps.cfg.outputs.asset }}"
 
           BODY=$(printf '%s\n' \
-            "Automatic build of \`${{ steps.cfg.outputs.branch }}\` at \`${GITHUB_SHA::8}\` — **not a release**." \
+            "Automatic build of \`${{ steps.cfg.outputs.branch }}\` at \`${{ steps.cfg.outputs.short_sha }}\` — **not a release**." \
             "" \
             "Installs as **JellyTau Debug** (\`com.dtourolle.jellytau.debug\`), alongside a" \
             "normal install and with its own separate data. It cannot replace or upgrade a" \