ci: chain APK build → image build via needs (fix race)

Previous design: android.yml's release job and release.yml ran in
parallel on every tag push. release.yml polled the gitea release-
download URL for up to 15 min waiting for the APK to appear. In
practice the polling step was completing in 11s — either following a
gitea redirect to a 200 page and writing HTML into the bundled APK
file, or returning empty content silently. Either way the resulting
image shipped without a working APK and the web Settings page's
in-app-update section never rendered.

Fix the race architecturally:

- Move the signed-release-build + Attach-APK steps out of android.yml
  and into a new android-release job in release.yml.
- release.yml's image-release job declares needs: [android-release],
  so on tag pushes the image cannot start building until the APK is
  guaranteed-attached.
- Pass the APK between jobs via actions/upload-artifact@v3 +
  download-artifact@v3 (the v2 backend isn't supported on Gitea).
  This removes the polling loop entirely — the image-release job just
  downloads the artifact, renames to minstrel.apk, writes the
  .version sidecar, and continues to docker buildx.
- For main pushes android-release is skipped via its if: condition.
  image-release uses  so it
  still runs (the skipped predecessor doesn't poison the chain) and
  the download/stage steps gate themselves on the tag context. Main
  images ship without an APK by design, same as before.

android.yml is now testing-only: lint + detekt + unit tests on every
push, debug APK artifact on main. Independent of release CI as
requested.

.gitea/workflows/android.yml

@@ -1,19 +1,14 @@
 name: android
 
 # Native Android (Kotlin/Compose/Media3) — M8 rewrite, now the only client.
-# At cutover (M8 phase 14.4) the asset name flipped from
-# minstrel-android-<tag>.apk to minstrel-<tag>.apk so the server's bundled
-# in-app-update channel (release.yml polls this name) resolves to the
-# native APK with no further changes.
-#
-# Tag format: vYYYY.MM.DD (per-day CalVer, mutable within the day). If a
-# tag is force-moved within the day, this workflow re-runs and overwrites
-# the existing release asset — same name, new content.
+# This workflow is testing only — lint + detekt + unit tests on every push
+# to dev/main, plus a debug APK artifact for main. The signed-release
+# build + asset attach + image-bundling lives in release.yml under a
+# `needs:` chain so the docker image cannot ship without the APK.
 
 on:
   push:
     branches: [main, dev]
-    tags: ['v*']
     paths:
       - 'android/**'
       - '.gitea/workflows/android.yml'
@@ -92,90 +87,3 @@ jobs:
         with:
           name: minstrel-android-debug-${{ github.sha }}
           path: android/app/build/outputs/apk/debug/app-debug.apk
-
-  release:
-    name: Build signed release APK
-    needs: build
-    if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: flutter-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-android:36
-
-    defaults:
-      run:
-        working-directory: android
-
-    env:
-      # PKCS12 keystores collapse store + key password into a single
-      # value, so both env vars map to one secret. build.gradle still
-      # reads them separately to stay format-agnostic.
-      ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
-      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Make gradlew executable
-        run: chmod +x ./gradlew
-
-      - name: Decode signing keystore
-        # Reuses the same keystore env-var contract as flutter.yml so the
-        # native APK is signed with the same key — Android will accept
-        # the upgrade in place at cutover without uninstall.
-        env:
-          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
-        shell: bash
-        run: |
-          if [ -z "${ANDROID_KEYSTORE_B64}" ]; then
-            echo "::error::ANDROID_KEYSTORE_B64 missing"; exit 1
-          fi
-          KEYSTORE_PATH="${RUNNER_TEMP}/minstrel-release.keystore"
-          echo "${ANDROID_KEYSTORE_B64}" | base64 -d > "${KEYSTORE_PATH}"
-          echo "ANDROID_KEYSTORE_PATH=${KEYSTORE_PATH}" >> "${GITHUB_ENV}"
-
-      - name: Build release APK
-        run: ./gradlew assembleRelease
-
-      - name: Attach APK to release
-        # M8 phase 14.4 cutover: the asset is now minstrel-<tag>.apk so
-        # release.yml's bundled in-app-update fetcher (which polls this
-        # exact filename) resolves to the native APK with no further
-        # workflow plumbing.
-        #
-        # Previous version of this step silently exited 0 on a failed
-        # upload because the curl exit code was being swallowed by the
-        # implicit shell. set -euxo pipefail surfaces it, and -w "...\n"
-        # forces curl to print the HTTP status of the upload so a 4xx
-        # is visible in the log.
-        shell: bash
-        env:
-          CI_TOKEN: ${{ secrets.CI_TOKEN }}
-        run: |
-          set -euxo pipefail
-          TAG="${GITHUB_REF#refs/tags/}"
-          REPO="${GITHUB_REPOSITORY}"
-          APK_PATH="app/build/outputs/apk/release/app-release.apk"
-          ls -lh "${APK_PATH}"
-
-          RELEASE_JSON="$(curl -fsSL \
-            -H "Authorization: token ${CI_TOKEN}" \
-            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/tags/${TAG}")"
-          RELEASE_ID="$(printf '%s' "${RELEASE_JSON}" | grep -oP '"id":\s*\K[0-9]+' | head -1)"
-          if [ -z "${RELEASE_ID}" ]; then
-            echo "::error::release for ${TAG} not found"; exit 1
-          fi
-          echo "release_id=${RELEASE_ID}"
-
-          UPLOAD_HTTP=$(curl -sS -L -o /tmp/upload.out -w '%{http_code}' \
-            -H "Authorization: token ${CI_TOKEN}" \
-            -F "attachment=@${APK_PATH}" \
-            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-${TAG}.apk")
-          echo "upload_http=${UPLOAD_HTTP}"
-          cat /tmp/upload.out || true
-          echo
-          if [ "${UPLOAD_HTTP}" -lt 200 ] || [ "${UPLOAD_HTTP}" -ge 300 ]; then
-            echo "::error::APK upload returned HTTP ${UPLOAD_HTTP}"
-            exit 1
-          fi