release-android-apk.yml writes an unvalidated version to GITHUB_ENV #181

Problem

The step extract version from package.json in release-android-apk.yml writes RELEASE_TAG=v${VERSION} to $GITHUB_ENV, with VERSION read from the caller's package.json. The value is not checked. A version string that contains a newline would add a second NAME=value line and so set another environment variable for the later steps.

The value comes from the caller's own repository, so the risk is low. Raised as a follow-up in the review of #180.

What to do

Validate VERSION against a version pattern before writing it (fail the step otherwise), or write it with the delimiter syntax for multi-line values. Check the other workflows that write a version read from a manifest to $GITHUB_ENV or $GITHUB_OUTPUT for the same pattern.