ci: run the fork's pipelines on the self-hosted runners

Squash of ten CI commits from 2026-08-04 (all part of HealthChat release 26.08.0):

- ci(release): move releases to the persistent self-hosted runners
- ci: grant contents:read so checkout works on this private fork
- ci: disable the Label Community PRs job on this fork
- ci: run the heavy Gradle jobs on the self-hosted runners
- ci: rely on the runner image for the Android SDK
- ci: size the Gradle heap for the self-hosted containers
- ci: report runner capacity on the self-hosted jobs
- ci: record why the Gradle heap is reduced
- ci: cap Gradle workers so test JVMs fit the container
- ci: skip the codecov upload when no token is configured

The danger.yml hunk from the contents:read commit is omitted: upstream
replaced Danger with a github-script workflow in v26.09.

.github/workflows/healthchat-release-playstore.yml

@@ -46,17 +46,24 @@ concurrency:
 
 env:
   # Upstream's workflows hardcode -Xmx8g / Kotlin daemon -Xmx4g, sized for the
-  # 4-core/16GB ubuntu-latest that public repos get. On this container the
-  # daemon keeps getting SIGKILLed mid-build (DaemonDisappearedException, no
-  # OutOfMemoryError, no heap dump), so stay well under upstream's ceiling and
-  # leave room for the Kotlin daemon and the parallel lint workers.
+  # 4-core/16GB ubuntu-latest that public repos get. On the previous incus
+  # container the daemon kept getting SIGKILLed mid-build
+  # (DaemonDisappearedException, no OutOfMemoryError, no heap dump), so these
+  # values stay well under upstream's ceiling and leave room for the Kotlin
+  # daemon and the parallel lint workers. Re-check them against the "Report
+  # runner capacity" output now that jobs land on the persistent org runners,
+  # whose specs may differ.
   GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx2g
   CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache
 
 jobs:
   release:
     name: Build and upload AAB to Play Store
-    runs-on: novaloop-incus-large
+    # Persistent org runners (github-runner-01, gha-runner-1..3). The previous
+    # novaloop-incus-large label pointed at the GARM ephemeral pool, whose freshly
+    # spawned runners were reaped mid-job — jobs died ~10 minutes in with
+    # "The operation was canceled" and no other diagnostic.
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -176,18 +183,14 @@ jobs:
           distribution: 'temurin'
           java-version: '21'
 
-      # The self-hosted runner image has no Android SDK (unlike GitHub-hosted
-      # ubuntu-latest), so install it here.
-      # - platform: follows COMPILE_SDK in plugins/src/main/kotlin/Versions.kt.
-      #   Platform packages are minor-versioned, so compileSdk 37 is android-37.0.
-      # - build-tools: nothing sets buildToolsVersion, so AGP picks its own
-      #   default (SdkConstants.CURRENT_BUILD_TOOLS_VERSION). Bump it when AGP is
-      #   upgraded, not when Versions.kt changes.
-      - name: Set up Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          packages: 'platforms;android-37.0 build-tools;36.0.0'
-
+      # The Android SDK now comes from the self-hosted runner image, so there is no
+      # setup-android step here. The image must provide it AND export ANDROID_HOME to
+      # the job environment — Gradle fails with "SDK location not found" otherwise.
+      # The image also has to carry the platform matching COMPILE_SDK in
+      # plugins/src/main/kotlin/Versions.kt (platform packages are minor-versioned, so
+      # compileSdk 37 means android-37.0) and the build-tools version AGP defaults to
+      # (SdkConstants.CURRENT_BUILD_TOOLS_VERSION), since nothing sets buildToolsVersion
+      # here. Both need refreshing in the image when AGP or COMPILE_SDK moves.
       - name: Configure gradle
         uses: gradle/actions/setup-gradle@v4