Pin OTA releases to main and stop dev builds outranking them

Two ways the updater could have served or blocked the wrong build:

- release.yml also triggers on workflow_dispatch, which can be aimed at
  any branch from the Actions UI. That would have built dev code and
  published it as a real Release, which every install would then offer to
  download. The job now refuses to run off anything but main.

- versionCode came from GITHUB_RUN_NUMBER, but that counter is per
  workflow, so the dev pipeline had its own independent sequence. A debug
  APK installed from a CI artifact already carried a higher versionCode
  than the first several releases would, and the updater's check is
  latest <= installed, so those users would have been told they were up
  to date indefinitely. Only release.yml now sets PLG_RELEASE, and only
  that stamps a real version; everything else stays at 1.0.0-dev.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015qjfMiPUDshdKEUa6vxqzN

.github/workflows/release.yml

@@ -19,7 +19,16 @@ concurrency:
 jobs:
   build:
     name: Build APK and publish release
+    # workflow_dispatch can be aimed at any branch from the Actions UI. Releases
+    # are what the in-app updater installs, so only main may produce one —
+    # anything else is a no-op rather than shipping unreviewed code to everyone.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    env:
+      # Tells the build this is a real release, so the APK is stamped with the
+      # run number that matches the tag below. Absent everywhere else, which
+      # keeps dev and local builds at 1.0.0-dev.
+      PLG_RELEASE: "1"
     steps:
       - name: Checkout
         uses: actions/checkout@v4