CI: manual-trigger only for all build workflows

Auto-triggers on push were noisy — every merged PR kicked off the
linux + android + ios-sim builds. Switching to workflow_dispatch only.
Trigger via Gitea Actions UI when you want a build. workflow_dispatch
runs as the authenticated user, so secrets are always present.

Adds the push trigger back when we want pre-merge gating or CI on every
commit (e.g., release-tag automation).

.github/workflows/build-android.yml

@@ -5,13 +5,9 @@ name: Hash Bags Android build
 # - PRs targeting dev/main (gate merges)
 # - manual via workflow_dispatch
 on:
-  # PR-from-fork triggers strip secrets in Gitea (and GitHub) for security.
-  # We mirror github-such-software/hash-wallet → Builds/hash-wallet via PRs,
-  # so a pull_request trigger here would always run without secrets.
-  # Listen only to push events on the destination branch (post-merge) so
-  # secrets are reliably available.
-  push:
-    branches: [dev, main]
+  # Manual-only for now. Trigger via Actions → "Hash Bags Android build"
+  # → Run workflow when you want a build. workflow_dispatch runs as the
+  # triggering user, so secrets are always available (unlike PR triggers).
   workflow_dispatch:
 
 concurrency:

.github/workflows/build-ios-sim.yml

@@ -8,9 +8,8 @@ name: Hash Bags iOS Simulator build
 # Phase 2 (separate workflow): full TestFlight pipeline with signing.
 
 on:
-  # See note in build-android.yml about Gitea PR-from-fork secret stripping.
-  push:
-    branches: [dev, main]
+  # Manual-only for now. Trigger via Actions → "Hash Bags iOS Simulator
+  # build" → Run workflow when you want a build.
   workflow_dispatch:
 
 # Cancel in-flight runs when a newer commit lands on the same branch — so a

.github/workflows/build-linux.yml

@@ -5,12 +5,9 @@ name: Hash Bags Linux build
 # - on PRs targeting dev/main (gates merges)
 # - manual via workflow_dispatch ("Run workflow" button in the UI)
 on:
-  # See note in build-android.yml about pull_request vs push triggers and
-  # Gitea Actions' from-fork secret stripping. Push-only here too for
-  # consistency (no secrets are required for Linux build today, but if we
-  # add any in future this avoids surprises).
-  push:
-    branches: [dev, main]
+  # Manual-only for now — auto-run on every push was too noisy. Trigger
+  # via Actions → "Hash Bags Linux build" → Run workflow when you want a
+  # build. Add `push:` back here if/when we want pre-merge validation.
   workflow_dispatch:
 
 concurrency: