ci: put java on PATH for the apksigner verify step

Gradle build is green (uses JAVA_HOME directly), but the signer-verify
step calls apksigner — a shell wrapper that needs 'java' on PATH. The
straw-build image sets JAVA_HOME without adding its bin to PATH for run
steps, so apksigner died with 'exec: java: not found'. Export it.

.forgejo/workflows/build.yml

@@ -86,6 +86,10 @@ jobs:
           # The whole series is signed with SHA-1 bb9ca96b...; fail loudly if a
           # build ever produces a different signer (would break in-place updates).
           # Pick whatever build-tools the image actually ships (36 today, not 34).
+          # apksigner is a shell wrapper that needs `java` on PATH; the image
+          # sets JAVA_HOME but doesn't put its bin on PATH for run steps (gradle
+          # uses JAVA_HOME directly, so the build itself is fine).
+          export PATH="$JAVA_HOME/bin:$PATH"
           APKSIGNER=$(ls "$ANDROID_HOME"/build-tools/*/apksigner | sort -V | tail -1)
           FP=$("$APKSIGNER" verify --print-certs "$APK" | grep -i 'SHA-1' | grep -o '[0-9a-f]\{40\}')
           echo "signer SHA-1: $FP"