TEMPORARY: force the APK job red to watch the image gate reject (#5419)

Reverted by the next commit. Expect: build fails, server-image skipped,
no ci.yml dispatch, :dev unmoved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/android.yml

@@ -116,6 +116,9 @@ jobs:
         working-directory: android
 
     steps:
+      - name: TEMPORARY forced failure (#5419, reverted next commit)
+        run: exit 1
+
       - uses: actions/checkout@v4
         with:
           # Derives a version, so it needs the whole history — see the note in
@@ -324,7 +327,7 @@ jobs:
   server-image:
     name: Build the server image
     needs: [decide, rust, build]
-    if: always() && needs.decide.outputs.build == 'true' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
+    if: needs.decide.outputs.build == 'true' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
     runs-on: flutter-ci
     container:
       # The image the dispatch has always run in, so its curl is a known quantity.
@@ -337,15 +340,15 @@ jobs:
       # push that touches the Android app (its `gate` job) and waits to be called
       # from here — that is the other half of this.
       #
-      # `always()`: a FAILED Android build — or failed core checks, which skip the
-      # build job entirely — must still let the server image through. There is no
-      # new client in that case, so it bakes in the previous one, which is exactly
-      # right — the alternative is a broken Android lane silently blocking server
-      # delivery. Its own job for that reason: a step inside `build` never runs
-      # when `build` is skipped.
+      # No `always()`: a red core check or APK build means no image for this
+      # commit (rule 177, #5419). This used to run regardless, on the reasoning that
+      # a broken Android lane shouldn't block server delivery, and the image would
+      # bake in the previous client. Run 8839 is what that meant: `:<sha>` published
+      # for 0ecdbfe while its APK lane (8835) was red, holding a client that wasn't
+      # from that commit. The previous `:dev` stays where it is; fix forward.
       #
-      # Not `if: success()` and not skipped on tags either: every ref that builds an
-      # image needs the call, or nothing builds one at all.
+      # Not skipped on tags: every ref that builds an image needs the call, since
+      # ci.yml stands down on these pushes and nothing else builds one.
       - name: Build the server image now the client is published
         env:
           GITHUB_TOKEN: ${{ github.token }}