Publish Android APK artifacts only from main

[sambitcreate]

Summary

• keep Android unit, lint, compilation, and Compose UI validation on relevant pull requests
• assemble, checksum, and upload the installable debug APK only for relevant pushes to main
• add CI policy coverage and clarify the artifact behavior in the README

Validation

• npm run test:branding (51 tests passed)
• npx eslint scripts/check-ci-policy.test.mjs
• CI workflow YAML parse
• git diff --check

[pullfrog]

✅ No new issues found.

Reviewed changes — This commit moves the installable Android debug APK out of the PR verification path: :app:assembleDebug is dropped from the "Verify Android" step, and the assemble, checksum, and upload steps are all gated on github.event_name == 'push' && github.ref == 'refs/heads/main'. Pull requests keep the unit-test, lint, and Compose UI gates without producing an artifact. The change also extends scripts/check-ci-policy.test.mjs with a workflowStep() helper that pins the new layout (Verify no longer assembles; assemble/checksum/upload all carry the main-push-only condition), and updates the README's mobile-distribution paragraph.

I validated the workflow YAML parses, the new policy assertions pass against the current ci.yml, the policy test is registered in both test:branding and test:model-catalog, and no other workflow or doc depends on PR-published APK artifacts. The if condition is technically redundant with the workflow's push: branches: [main] trigger, but as a step-level, machine-checkable guard it's the right shape and survives future trigger changes.

ℹ️ Stale CI description in the active Aiden On The Go plan

docs/plans/aiden-on-the-go-plan.md:889 (an active plan, not archived) still states that pull-request CI runs "debug assembly" and "publishes the installable debug APK plus its SHA-256 checksum as a 14-day workflow artifact." Both facts change with this PR: PRs no longer assemble or publish, and the 14-day artifact is now main-push-only. Worth a one-line touch-up so the plan's CI description stays accurate.

Technical details

# Stale CI description in aiden-on-the-go-plan.md

## Affected sites
- docs/plans/aiden-on-the-go-plan.md:889 — claims PR CI assembles the debug APK and publishes it as a 14-day artifact

## Required outcome
- Update the sentence to reflect that PR CI runs verification only (JVM tests, lint, Android-test compilation) and the installable debug APK plus checksum is published only from `main` pushes

## Suggested approach (optional)
- Mirror the wording now in README.md:94 ("Pull requests run the Android verification gates without retaining an installable artifact; relevant merges to `main` publish the debug APK and its checksum")

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Flash ｜ 𝕏}