include glyph sdk to release build

README.md

@@ -299,7 +299,7 @@ Secrets, all under *Repository → Settings → Actions → Secrets*:
 
 | Secret | For |
 | --- | --- |
-| `REGISTRY_TOKEN` | only when the built-in `GITEA_TOKEN` cannot push to the Gitea registry (older Gitea, or restricted token permissions); `package:write` is needed. `REGISTRY_USER` is optional and defaults to the repository owner |
+| `REGISTRY_TOKEN` | publishing the image: **a personal access token with `package:write`**. Gitea's built-in `GITEA_TOKEN` is read-only for packages, so it cannot be used here. `REGISTRY_USER` is optional and defaults to the repository owner. Without this secret the `docker` workflow still builds and smoke-tests the image, but skips the push |
 | `KADENCE_KEYSTORE_BASE64` | `base64 -w0 your.keystore` |
 | `KADENCE_KEYSTORE_PASSWORD`, `KADENCE_KEY_ALIAS`, `KADENCE_KEY_PASSWORD` | the key inside it |
 
@@ -310,10 +310,13 @@ secret **fail the build**: the Gradle config otherwise falls back to the debug k
 without a word, and a debug-signed "release" installs happily and can then never
 be upgraded by a properly signed one.
 
-The Glyph Matrix AAR is deliberately not fetched in CI — its licence forbids
-redistribution, and the build compiles the `noglyph` source set without it, so a
-CI APK has an inert rear display. That is also the correct behaviour on any phone
-that is not a Nothing.
+The Glyph Matrix AAR is not committed — its licence forbids redistribution — so
+the APK job runs `android/fetch-glyph-sdk.sh` before Gradle configures the app,
+downloading it from Nothing's developer kit. The resulting CI APK therefore
+contains the real rear-display implementation; the `noglyph` no-op fallback is
+only used for local builds where the AAR has not been fetched. Because the
+licence forbids redistribution, the downloaded AAR stays out of the artifacts:
+only the finished APK is uploaded.
 
 ---