ci: pin and least-privilege Android workflows

[Jeremy1844]

DO NOT MERGE: hosted fork/no-secret validation, protected-environment review, replay after #1556, and a non-production release/rollback rehearsal are still required.

Root cause

The five Android workflows trusted mutable external-action refs, relied on implicit token permissions, and allowed checkout credentials to persist. The two release-writing paths also lacked explicit non-cancelling concurrency boundaries, and the Play job lacked a defensive full-ref guard.

This is the single action-provenance and workflow-trust-boundary root tracked as ADV-2026-0033 / RC-0033. It is based on main at 55405f66a8c555047dc0035747acdcaa371d59fa.

Change

• Pin all 14 active external-action uses to reviewed full commit SHAs.
• Default every workflow token to contents: read, granting writes only to the jobs that label PRs or update releases.
• Set persist-credentials: false on all four checkouts.
• Serialize release-asset and Play submissions without cancelling a running release.
• Preserve the existing main/develop release behavior while adding a defensive full-ref guard.
• Add a fail-closed policy test that inventories every workflow/action and rejects mutable or unreviewed refs, excess permissions, persistent credentials, unsafe release boundaries, or removal of the policy from ordinary CI.

No application code, content, signing material, release credential, persistence format, or user data changes.

Red/green evidence

• Red commit de799a5998d1a926e0fd68cf337f6f3bc739d3d6: expected failure, 0/6 policy groups passed.
• Green commit 2ad6104c258e115b17ab90af118cd07a7773be14: 6/6 policy groups passed; tree eee2a593ae127ac2036c136f53256f806cbc9949.
• Immutable action inventory: 14/14 exact allowlisted commits.
• Actionlint 1.7.12: PASS, zero diagnostics across 5/5 workflows.
• Independent js-yaml 4.1.0 parse: PASS, 5/5 workflow mappings.
• Complete Gradle check on the byte-identical green tree: PASS, 2,681/2,681 tasks in 4m41s; zero lint errors and 22 inherited warnings.
• Release bundle graph: PASS under --dry-run; both signing tasks were present and skipped.
• Diff/ancestry/path/identity checks: PASS; exactly two noreply-authored commits, six expected files, +306/-16, and a clean worktree.

No signing, decryption, artifact upload, release, Play submission, deployment, or workflow dispatch was performed.

Version decision

actions/checkout remains on the reviewed immutable v6 commit d23441a48e516b6c34aea4fa41551a30e30af803. It is an official signed Node 24 revision and is the version exercised by the complete tested tree. Moving to v7.0.1 adds behavior and dependency changes and should receive its own focused review rather than changing this root during publication.

actions/upload-release-asset remains an archived, unsigned Node 12 action. Its full-SHA pin contains provenance drift but does not modernize the runtime. Replacement is a separate behavior-tested root and remains a merge gate for release enablement.

Open-PR overlap and required order

• fix(android): remove keepScreenOn to prevent burn-in #1548–fix(block-kit): preserve readable text in highlights #1553: no changed-path overlap with this branch.
• ci(android): run push quality gates on pull requests #1554: textually composes, but its new mutable action refs make this policy fail. Replay ci(android): run push quality gates on pull requests #1554 after build(android): freeze main toolchain and dependency inputs #1556 and this root, review each added action commit, and update the inventory deliberately.
• ci(android): keep release secrets out of push checks #1555: overlaps on_push.yml; the merged tree is clean and both workflow policies pass.
• build(android): freeze main toolchain and dependency inputs #1556: overlaps all five workflows and conflicts in two release workflows. Land build(android): freeze main toolchain and dependency inputs #1556 first, then replay this red/green pair and rerun the full matrix. Do not merge this draft as-is over build(android): freeze main toolchain and dependency inputs #1556.
• build(android): make develop toolchain inputs reproducible #1557: targets develop; preserve the documented order #1557 -> corrected ADV-2026-0033 -> develop ADV-2026-0054 -> ADV-2026-0073.

Remaining safety gates

1. Rebase/replay after the accepted CI prerequisites, especially build(android): freeze main toolchain and dependency inputs #1556, then rerun policy, actionlint, YAML, and the complete Gradle matrix.
2. Run GitHub-hosted Ubuntu/macOS checks first on a fork/no-secret event, then on an authorized same-repository no-deploy event.
3. Verify protected environments, required reviewers, branch restrictions, wait timers, and narrowly scoped short-lived deployment identities with a maintainer.
4. Replace the archived Node 12 release-asset action in its own tested PR.
5. Preserve the last-known-good signed artifact and Play/release state, then rehearse staging rollback and concurrent release behavior with no production write.
6. Review private dependency/security alerts and organization/branch rules through the authorized maintainer channel.

Migration, recovery, and rollback

There is no persistence or schema migration. Operationally, release writers queue instead of racing, and later steps no longer inherit checkout credentials. Prefer a forward fix pinned to a newly reviewed commit. If concurrency/ref behavior needs correction, retain immutable pins, least permissions, and non-persistent credentials; never restore floating refs, implicit broad permissions, or persisted credentials.