ci: run the fork's pipelines on the self-hosted runners

Squash of ten CI commits from 2026-08-04 (all part of HealthChat release 26.08.0):

- ci(release): move releases to the persistent self-hosted runners
- ci: grant contents:read so checkout works on this private fork
- ci: disable the Label Community PRs job on this fork
- ci: run the heavy Gradle jobs on the self-hosted runners
- ci: rely on the runner image for the Android SDK
- ci: size the Gradle heap for the self-hosted containers
- ci: report runner capacity on the self-hosted jobs
- ci: record why the Gradle heap is reduced
- ci: cap Gradle workers so test JVMs fit the container
- ci: skip the codecov upload when no token is configured

The danger.yml hunk from the contents:read commit is omitted: upstream
replaced Danger with a github-script workflow in v26.09.

.github/workflows/maestro-local.yml

@@ -5,11 +5,22 @@ on:
   workflow_dispatch:
   pull_request:
 
-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read
 
 # Enrich gradle.properties for CI/CD
 env:
-  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx8g -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx4g
+  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
+  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
+  # but the containers are oversubscribed against their host, and two concurrent heavy
+  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
+  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
+  # make two builds likelier to coexist; the real fix is sizing the containers to the
+  # host. See the "Report runner capacity" step.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx2g
   CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache
   ARCH: x86_64
   DEVICE: pixel_7_pro
@@ -19,7 +30,7 @@ env:
 jobs:
   build-apk:
     name: Build APK
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     # Secrets are not available to pull_request runs from forks, so the Maestro job below
     # cannot run for them; skip the build too, as its only consumer is that job.
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
@@ -28,6 +39,9 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Free Disk Space (Ubuntu)
+        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
+        # would delete dotnet/haskell/docker images from the host on every run.
+        if: runner.environment == 'github-hosted'
         uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
         with:
           # This might remove tools that are actually needed, if set to "true" but frees about 6 GB