[macro88]

The protected Android signing job failed during setup-node: its default automatic caching detects pnpm in package.json, but this job has no package manager installed. Disable automatic caching for that step so signing can proceed using Node built-ins and the Android tools.

Also restrict push-triggered CI to main, retaining pull-request and manual runs. This removes duplicate feature-branch runs while preserving the exact-main-commit CI prerequisite for release packaging.

Validation:

• Executed the exact pinned setup-node bundle locally with Node 24.20.0 and pnpm absent: the default reproduces the missing-pnpm error; package-manager-cache: false succeeds.
• Exercised the signing script against the built unsigned APK in an isolated fixture with a disposable RSA key, no pnpm and no installed dependencies. Signing, certificate verification, APK content/alignment checks and draft metadata all pass. Production credentials and public release creation were not exercised.
• All 13 release regressions pass; workflow YAML and intended triggers validate. React Doctor and AISlop score 100/100; all ten dependency audits pass.

After merge and successful main CI, start a fresh manual release run to use the repaired workflow.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.