- trigger: add branches: [dev, main] so analyze+test run on every
push, not just release tags. Build job stays tag-gated via
if: startsWith(github.ref, 'refs/tags/')
- pin Flutter to 3.41.6 instead of floating :stable for reproducible
release builds
- concurrency: cancel in-progress non-tag runs
- permissions: contents: read default, contents: write scoped to build
- extract release publish logic to scripts/publish_apk_release.sh so
it's testable locally (bash -x with env vars) and the YAML stays
readable. Adds set -euo pipefail + curl -f so failures surface
instead of getting swallowed by || echo "skipped"
- drop the broken artifact upload step (silently swallowed errors)
