build: target Android SDK 37, use Rust 1.98.1 and add a safe mode run

Moves to AGP 9.4.1 and Gradle 9.8.0; Rust 1.98.1 lets macOS 27 load
rust_api. Android 17 treats the tun subnet as local network, so starting
the VPN asks for that permission and falls back to gvisor without it.
Signed release builds upload native symbols to Crashlytics.

tool/changelog.dart

@@ -123,9 +123,13 @@ int _render(String root, ArgResults command) {
 
   final output = switch (rest.first) {
     'release' => renderRelease(version),
+    // Only stable builds pass --tag, and only they get a release page; a
+    // prerelease caption already links its workflow run.
     'telegram' => renderTelegram(
       version,
-      moreUrl: 'https://github.com/$_repository/releases',
+      moreUrl: tag == null
+          ? null
+          : 'https://github.com/$_repository/releases/tag/$tag',
     ),
     _ => _fail('Unknown render target: ${rest.first}'),
   };

tool/src/changelog/render.dart

@@ -98,7 +98,7 @@ String escapeTelegramHtml(String value) => value
 
 /// Telegram captions are capped at 1024 characters, so the text is truncated
 /// with a pointer to the full notes instead of failing the upload.
-String renderTelegram(ChangelogVersion version, {required String moreUrl}) {
+String renderTelegram(ChangelogVersion version, {String? moreUrl}) {
   final buffer = StringBuffer();
   if (version.isEmpty) {
     buffer.writeln('• ${escapeTelegramHtml(emptyVersionNote)}');
@@ -111,21 +111,27 @@ String renderTelegram(ChangelogVersion version, {required String moreUrl}) {
     buffer.writeln();
   }
   final text = buffer.toString().trimRight();
-  if (text.length <= telegramLimit) {
+  if (_telegramVisibleLength(text) <= telegramLimit) {
     return text;
   }
-  final cut = text.substring(0, telegramLimit);
-  final lastBreak = cut.lastIndexOf('\n');
-  // Cut on a line break so the cut never lands inside a tag; the trailing
-  // pattern covers the one case that has no break to cut on, where the cut can
-  // still land halfway through an entity.
-  final kept = (lastBreak < 0 ? cut : cut.substring(0, lastBreak)).replaceAll(
-    RegExp(r'&[A-Za-z]*$|<[^>]*$'),
-    '',
-  );
-  return '$kept\n\n…\n$moreUrl';
+  final kept = StringBuffer();
+  var length = 0;
+  for (final line in text.split('\n')) {
+    length += _telegramVisibleLength(line) + 1;
+    if (length > telegramLimit) {
+      break;
+    }
+    kept.writeln(line);
+  }
+  final more = moreUrl == null ? '' : '\n$moreUrl';
+  return '${kept.toString().trimRight()}\n\n…$more';
 }
 
+int _telegramVisibleLength(String markup) => markup
+    .replaceAll(RegExp('<[^>]*>'), '')
+    .replaceAll(RegExp('&[a-z]+;'), '&')
+    .length;
+
 /// Version headings stay the only `##` level; groups are bold lines because a
 /// release carries a handful of entries and an `###` per group outweighs them.
 String _heading(ChangelogVersion version) => version.date.isEmpty