When the Android workflow is dispatched against a tag (which is how our
Releases are cut) with the production profile, attach the signed universal
APK to the matching GitHub Release as Bluesky-<version>.apk.
Runs as a separate attachToRelease job so that contents: write is isolated
there and the build job stays read-only. Only attaches to a release that
already exists — never creates one — and pings Slack on success.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Eric Bailey
5be493ceab