ci(android): run push quality gates on pull requests

[Jeremy1844]

Dependency/rebase notice (audit update): Keep this draft unmerged. Android reproducibility draft #1556 must land first. The corrected one-root replay is parked on the fork-only branch staging/adv-2026-0051-after-0058 at b968dcf0e19c9a94851cd94f48b863c5fc1a2330; no upstream PR was opened for that dependent head because it would currently bundle #1556. After #1556 lands, replay onto the actual landed SHA, rerun the full gate, and update this draft with an exact lease. Current hosted runs are action_required with zero jobs, so no hosted pass is claimed.

Audit root

• Audit ID: ADV-2026-0051 / RC-0051
• Base: 55405f66a8c555047dc0035747acdcaa371d59fa
• Head: ddd5a410a86d709eb90d002dbbc3bbc3411add41
• Scope: one commit, one root, 2 files, +171

Why

Pull requests currently run a macOS release bundle but omit the two quality commands required after push: ./gradlew check and ./gradlew testDebugUnitTest -Proborazzi.test.verify=true. A PR can therefore appear green and fail immediately after merge on compilation, lint, formatting, unit, or configured screenshot checks.

Minimal fix

Add a bounded, secret-free Ubuntu quality job with contents: read, non-persisting checkout, the repository's JDK 21/Gradle setup, a dependency-free fail-closed policy, and the exact two push-quality commands. The existing macOS release-bundle job is preserved byte-for-byte.

No application code, content, schema, cache, persistence, signing, store, release artifact, or deployment behavior changes are included.

Regression evidence

• Expected RED: the policy exits 1 on the audited base and reports the missing least-privilege job and parity commands.
• PASS: policy and Actionlint 1.7.12.
• PASS: full Gradle check, 2,681 tasks.
• PASS: configured unit lane, 1,029 tasks; app 17/17 and app-tv 22/22.
• PASS: preserved app:bundleRelease, 1,200 tasks.
• PASS: exact diff/ancestry and clean-worktree checks.

The published commit uses the account's GitHub noreply identity while preserving the tested tree, parent, message, dates, and stable patch ID.

Overlap and gates

Open Android PRs #1548-#1553 have zero changed-file/root overlap; all six merge-tree checks pass. ADV-0054 changes the push secret boundary and remains a separate, file-disjoint PR. ADV-0069 owns complete canonical Roborazzi coverage and must also remain separate.

Keep this PR in draft until first-time-fork approval, the exact hosted Ubuntu quality job, the preserved hosted macOS release-bundle job, privacy/log review, timeout observation, and required-check transition review pass. No merge, release, or deployment is authorized by local evidence.