ci(flutter): build debug APK on main only, not every dev push

The debug APK step dominated the run (~7m32s of ~10m) and ran on
every dev push, but the operator dev-tests via a local Android
Studio build, not the CI artifact. Gate the debug APK + its
artifact upload to main pushes only: dev = analyze+test+codegen
(~3min); main = + debug APK as the native-build safety net
(Gradle/manifest/plugin breakage analyze+test can't catch) before
any release tag; tags = signed release APK (unchanged).

Note: the bulk of that 7m32s was the flutter-ci runner image
re-installing NDK 28.2.13676358 + build-tools 35 + platform 35/36
+ cmake 3.22.1 every run (image baked platform-34/build-tools-34,
stale vs the bundled Flutter's requirements). Baking those into
CI-Runner/CI-flutter/Dockerfile is the larger win and also speeds
release builds — tracked separately (operator-side infra, not in
this repo).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/flutter.yml

@@ -1,9 +1,13 @@
 name: flutter
 
-# Analyze + test + build the Flutter mobile client. Only runs when the
+# Analyze + test the Flutter mobile client; build an APK only where
-# diff touches flutter_client/ or one of the shared web inputs the
+# it's actually consumed. dev pushes: analyze+test+codegen only
-# sync_shared.sh script copies. Other pushes skip — this workflow is
+# (~3min) — the operator dev-tests via a local Android Studio build,
-# independent from the Go/web test.yml and release.yml.
+# not the CI artifact. main pushes: also build a debug APK as the
+# native-build safety net (Gradle/manifest/plugin breakage that
+# analyze+test can't catch) before any release tag. tags: signed
+# release APK. Only runs when the diff touches flutter_client/ or a
+# shared web input sync_shared.sh copies.
 
 on:
   push:
@@ -69,7 +73,9 @@ jobs:
         run: flutter test --reporter compact
 
       - name: Build debug APK
-        if: github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')
+        # main-only: native-build safety net before release tags.
+        # dev skips this (~7min) — operator dev-tests locally.
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: flutter build apk --debug
 
       - name: Decode signing keystore
@@ -112,7 +118,7 @@ jobs:
           flutter build apk --release --build-name="${TAG}"
 
       - name: Upload debug APK artifact
-        if: github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: forgejo/upload-artifact@v3
         with:
           name: minstrel-debug-${{ github.sha }}