ci: publish :latest from main + native APK as minstrel-<tag>.apk

Two related cutover changes so the rolling stable channel works end
to end after the Flutter sunset.

release.yml:
- Main pushes now tag both :main and :latest. Main is the protected
  post-PR-merge branch and the team's stable channel; pinning to
  :latest gets the newest main automatically while :vX.Y.Z stays
  available for pinned consumers.

android.yml:
- Asset attach renamed from minstrel-android-<tag>.apk to
  minstrel-<tag>.apk (M8 phase 14.4 cutover). Without this, the
  server image's bundled in-app-update fetcher in release.yml polls
  a filename that no workflow produces, so /api/client/version
  returns 404 and the web UI's MobileAppDownload silently renders
  nothing. With this rename the existing fetcher resolves to the
  native APK with no further plumbing.

No code paths change; both fixes are workflow rewires.

.gitea/workflows/android.yml

@@ -1,9 +1,10 @@
 name: android
 
-# Native Android (Kotlin/Compose/Media3) — M8 rewrite of the Flutter client.
-# Lives side-by-side with flutter_client/ until cutover; both APKs ship from
-# their respective release artifacts (minstrel-<tag>.apk = Flutter,
-# minstrel-android-<tag>.apk = native) during the transition.
+# Native Android (Kotlin/Compose/Media3) — M8 rewrite, now the only client.
+# At cutover (M8 phase 14.4) the asset name flipped from
+# minstrel-android-<tag>.apk to minstrel-<tag>.apk so the server's bundled
+# in-app-update channel (release.yml polls this name) resolves to the
+# native APK with no further changes.
 
 on:
   push:
@@ -129,11 +130,10 @@ jobs:
         run: ./gradlew assembleRelease
 
       - name: Attach APK to release
-        # During the side-by-side period the asset name is
-        # minstrel-android-<tag>.apk so it doesn't collide with the
-        # Flutter app's minstrel-<tag>.apk. At cutover, flip this name
-        # to minstrel-<tag>.apk and deactivate the flutter.yml release-
-        # attach step (M8 phase 14.4).
+        # M8 phase 14.4 cutover: the asset is now minstrel-<tag>.apk so
+        # release.yml's bundled in-app-update fetcher (which polls this
+        # exact filename) resolves to the native APK with no further
+        # workflow plumbing.
         shell: bash
         env:
           CI_TOKEN: ${{ secrets.CI_TOKEN }}
@@ -150,4 +150,4 @@ jobs:
           curl -fsSL \
             -H "Authorization: token ${CI_TOKEN}" \
             -F "attachment=@app/build/outputs/apk/release/app-release.apk" \
-            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-android-${TAG}.apk"
+            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-${TAG}.apk"

.gitea/workflows/release.yml

@@ -2,7 +2,7 @@ name: release
 
 # Builds and pushes the minstrel container image to the Gitea registry.
 #
-#   push to main         → :main
+#   push to main         → :main and :latest
 #   push tag vX.Y.Z      → :vX.Y.Z and :latest
 #   workflow_dispatch    → manual trigger (same rules based on the ref)
 
@@ -55,9 +55,13 @@ jobs:
             echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "::notice::Release build: ${VERSION} + latest"
           else
-            echo "args=-t ${IMAGE}:main" >> "$GITHUB_OUTPUT"
+            # Main is the protected, post-PR-merge branch. Treat it as the
+            # rolling stable channel — every main push moves :latest.
+            # Pinned consumers can target :vX.Y.Z; everyone else gets the
+            # newest main.
+            echo "args=-t ${IMAGE}:main -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
             echo "version=main" >> "$GITHUB_OUTPUT"
-            echo "::notice::Main-branch build: :main"
+            echo "::notice::Main-branch build: :main + :latest"
           fi
 
       - name: Registry login