ci: run the fork's pipelines on the self-hosted runners

Squash of ten CI commits from 2026-08-04 (all part of HealthChat release 26.08.0):

- ci(release): move releases to the persistent self-hosted runners
- ci: grant contents:read so checkout works on this private fork
- ci: disable the Label Community PRs job on this fork
- ci: run the heavy Gradle jobs on the self-hosted runners
- ci: rely on the runner image for the Android SDK
- ci: size the Gradle heap for the self-hosted containers
- ci: report runner capacity on the self-hosted jobs
- ci: record why the Gradle heap is reduced
- ci: cap Gradle workers so test JVMs fit the container
- ci: skip the codecov upload when no token is configured

The danger.yml hunk from the contents:read commit is omitted: upstream
replaced Danger with a github-script workflow in v26.09.

.github/workflows/pull_request.yml

@@ -23,33 +23,38 @@ jobs:
           script: |
             core.setFailed("PR has been labeled with X-Blocked; it cannot be merged.");
 
-  community-prs:
-    name: Label Community PRs
-    runs-on: ubuntu-latest
-    if: github.event.action == 'opened'
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Check membership
-        if: github.event.pull_request.user.login != 'renovate[bot]'
-        uses: tspascoal/get-user-teams-membership@b2546c5affc730fd8e3d8483ae9ad3621938c2f9 # v4.0.2
-        id: teams
-        with:
-          username: ${{ github.event.pull_request.user.login }}
-          organization: element-hq
-          team: Vector Core
-          GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN_READ_ORG }}
-      - name: Add label
-        if: steps.teams.outputs.isTeamMember == 'false'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            github.rest.issues.addLabels({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              labels: ['Z-Community-PR']
-            });
+  # Disabled on the HealthChat fork. This job asks whether the PR author belongs to the
+  # element-hq "Vector Core" team, using secrets.ELEMENT_BOT_TOKEN_READ_ORG — a secret
+  # that only exists upstream. Here it fails on every PR that is opened, and there is no
+  # community to label anyway. Kept commented rather than deleted so upstream changes to
+  # it still conflict visibly on merge.
+  # community-prs:
+  #   name: Label Community PRs
+  #   runs-on: ubuntu-latest
+  #   if: github.event.action == 'opened'
+  #   permissions:
+  #     pull-requests: write
+  #   steps:
+  #     - name: Check membership
+  #       if: github.event.pull_request.user.login != 'renovate[bot]'
+  #       uses: tspascoal/get-user-teams-membership@b2546c5affc730fd8e3d8483ae9ad3621938c2f9 # v4.0.2
+  #       id: teams
+  #       with:
+  #         username: ${{ github.event.pull_request.user.login }}
+  #         organization: element-hq
+  #         team: Vector Core
+  #         GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN_READ_ORG }}
+  #     - name: Add label
+  #       if: steps.teams.outputs.isTeamMember == 'false'
+  #       uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+  #       with:
+  #         script: |
+  #           github.rest.issues.addLabels({
+  #             issue_number: context.issue.number,
+  #             owner: context.repo.owner,
+  #             repo: context.repo.repo,
+  #             labels: ['Z-Community-PR']
+  #           });
 
   close-if-fork-develop:
     name: Forbid develop branch fork contributions