Build PR OTA bundle in parallel with the fingerprint check

publish-pr-ota needed fingerprint-native, so the bundle build - the slow
half - did not start until the fingerprint had finished, even though the
bundle does not depend on the fingerprint verdict. Only the decision to
publish it does.

Split the job in two: build-pr-ota builds and assembles the bundle with no
dependency on the fingerprint (so it runs alongside it) and hands it over
as a short-lived artifact, and publish-pr-ota keeps the fingerprint gate
and does just the denis publish. A dirty fingerprint now discards an
already-built bundle instead of saving the build, which costs a runner but
takes the fingerprint's wall clock off the critical path of every
fingerprint-clean PR.

Since the build job already has the EAS CLI set up, it also reads the
native build numbers and exposes them (along with the release version) as
job outputs, so the publish job needs neither EXPO_TOKEN nor node_modules
and can invoke denisPublish.sh directly rather than through the
use-build-number wrapper. denisPublish.sh gains SKIP_BUNDLE_ASSEMBLY for
that case, where bundleTempDir arrives as an artifact and ./dist is not
present; without it the script assembles the directory as before, so the
main-branch deploy is unaffected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL83tcSq9MvwBkUGJGRyWV

scripts/denisPublish.sh

@@ -10,10 +10,21 @@ set -o nounset
 # (configure-aws-credentials OIDC), and BSKY_IOS_BUILD_NUMBER /
 # BSKY_ANDROID_VERSION_CODE from the use-build-number wrapper.
 
-rm -rf bundleTempDir
+# Set when bundleTempDir was assembled by a separate job and handed over as an
+# artifact, as the PR OTA flow does so the bundle can be built in parallel with
+# the fingerprint check. Without it, assemble the directory from ./dist here.
+if [ -n "${SKIP_BUNDLE_ASSEMBLY:-}" ]; then
+  echo "Using pre-assembled bundle directory..."
+  if [ ! -f bundleTempDir/metadata.json ]; then
+    echo "bundleTempDir/metadata.json is missing; nothing to publish" >&2
+    exit 1
+  fi
+else
+  rm -rf bundleTempDir
 
-echo "Assembling bundle directory..."
-node scripts/bundleUpdate.js
+  echo "Assembling bundle directory..."
+  node scripts/bundleUpdate.js
+fi
 
 if [ -z "$RUNTIME_VERSION" ]; then
   RUNTIME_VERSION=$(cat package.json | jq '.version' -r)