CI: drop pull_request triggers (Gitea strips secrets from fork PRs)

The Android workflow's 'ANDROID_KEYSTORE_BASE64 not set' failure is
secrets-not-reaching-runner, not a missing secret. The secret IS set
in Builds/hash-wallet's repo secrets. The issue: workflows are being
triggered by 'pull_request' events when github-such-software/hash-wallet
is mirrored into Builds/hash-wallet via PR. Gitea (and GitHub) Actions
deliberately strip secrets from workflows triggered by PRs from forks
to prevent rogue PRs from exfiltrating secrets.

Fix: drop the pull_request trigger from all auto-build workflows. Each
workflow now runs exactly once, on push to dev/main (post-merge), in
the destination repo's context, with secrets intact.

Also added a debug step in the Android keystore decode that prints
secret LENGTHS (never values) so future failures of this shape are
diagnosable immediately.

.github/workflows/build-android.yml

@@ -5,10 +5,13 @@ name: Hash Bags Android build
 # - PRs targeting dev/main (gate merges)
 # - manual via workflow_dispatch
 on:
+  # PR-from-fork triggers strip secrets in Gitea (and GitHub) for security.
+  # We mirror github-such-software/hash-wallet → Builds/hash-wallet via PRs,
+  # so a pull_request trigger here would always run without secrets.
+  # Listen only to push events on the destination branch (post-merge) so
+  # secrets are reliably available.
   push:
     branches: [dev, main]
-  pull_request:
-    branches: [dev, main]
   workflow_dispatch:
 
 concurrency:
@@ -189,8 +192,19 @@ jobs:
           ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
           set -e
+          # Debug visibility — prints lengths only, never values. If a secret
+          # length is 0, Gitea Actions is not passing it to this run (most
+          # commonly because the run was triggered by a from-fork PR).
+          echo "ANDROID_KEYSTORE_BASE64 length: ${#ANDROID_KEYSTORE_BASE64}"
+          echo "ANDROID_KEYSTORE_PASSWORD length: ${#ANDROID_KEYSTORE_PASSWORD}"
+          echo "ANDROID_KEY_ALIAS length: ${#ANDROID_KEY_ALIAS}"
+          echo "ANDROID_KEY_PASSWORD length: ${#ANDROID_KEY_PASSWORD}"
           if [[ -z "$ANDROID_KEYSTORE_BASE64" ]]; then
-            echo "FATAL: ANDROID_KEYSTORE_BASE64 not set — configure Gitea Actions secrets first"
+            echo "FATAL: ANDROID_KEYSTORE_BASE64 not reaching the runner."
+            echo "Check: (1) secret is in repo Settings → Actions → Secrets;"
+            echo "       (2) workflow was triggered by 'push' or 'workflow_dispatch'"
+            echo "           (PR triggers from a fork strip secrets);"
+            echo "       (3) Gitea's runner is configured to pass secrets."
             exit 1
           fi
           # Write decoded keystore next to build.gradle (storeFile path

.github/workflows/build-ios-sim.yml

@@ -8,10 +8,9 @@ name: Hash Bags iOS Simulator build
 # Phase 2 (separate workflow): full TestFlight pipeline with signing.
 
 on:
+  # See note in build-android.yml about Gitea PR-from-fork secret stripping.
   push:
     branches: [dev, main]
-  pull_request:
-    branches: [dev, main]
   workflow_dispatch:
 
 # Cancel in-flight runs when a newer commit lands on the same branch — so a

.github/workflows/build-linux.yml

@@ -5,10 +5,12 @@ name: Hash Bags Linux build
 # - on PRs targeting dev/main (gates merges)
 # - manual via workflow_dispatch ("Run workflow" button in the UI)
 on:
+  # See note in build-android.yml about pull_request vs push triggers and
+  # Gitea Actions' from-fork secret stripping. Push-only here too for
+  # consistency (no secrets are required for Linux build today, but if we
+  # add any in future this avoids surprises).
   push:
     branches: [dev, main]
-  pull_request:
-    branches: [dev, main]
   workflow_dispatch:
 
 concurrency: