ci: fix release build keystore path + add Node.js 24 opt-in

Root cause of recent CI failures:
  The fallback signing path was ${ANDROID_HOME}/debug.keystore which
  resolves to /usr/local/lib/android/sdk/debug.keystore on ubuntu-latest
  runners — a path that does not exist. The actual debug keystore lives
  at ~/.android/debug.keystore.

Fixes:
- Add 'Ensure debug keystore exists' step that runs keytool to generate
  the keystore at ~/.android/debug.keystore if absent (idempotent)
- Change fallback signing path to ${HOME}/.android/debug.keystore
- Add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true to env to opt into
  Node.js 24 for all actions before the June 2026 forced cutover
- Add Deployment & CI Checklist to copilot-instructions.md with common
  failure modes table so this is easy to diagnose in future

Author: blin

.github/copilot-instructions.md

@@ -128,3 +128,35 @@ Before adding ANY new dependency:
 - `BuildConfig.DEBUG` guards must wrap all verbose drive mode logging.
 - The `com.android.shell` entry in `isMessagingApp()` is gated on `BuildConfig.DEBUG` — keep it that way.
 - `DebugTestReceiver` is gated on `BuildConfig.DEBUG` — keep it that way.
+
+---
+
+## Deployment & CI Checklist
+
+**After every push to master, check the CI pipeline immediately:**
+
+1. Open [Actions → Build and Release](https://github.com/KonTy/SilentPulse/actions/workflows/release.yml)
+2. Wait for the run to complete (~7–8 minutes).
+3. If it fails, click the failed job → expand each step to find the first non-zero exit.
+4. Fix the root cause, push, and re-verify the next run passes before deploying to a device.
+
+### Common failure modes to know
+
+| Symptom | Root cause | Fix |
+|---|---|---|
+| `packageNoAnalyticsRelease FAILED` with no keystore secret | Wrong keystore path | Workflow now uses `${HOME}/.android/debug.keystore`; a `keytool` pre-step guarantees it exists |
+| APK glob `*.apk` matches nothing in release step | Release build failed silently | Check the `assembleNoAnalyticsRelease` step above it |
+| Node.js 20 action warning becomes error (after Jun 2026) | Outdated action runtime | `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` is set in the workflow env |
+
+### Signing secrets (for production releases)
+
+Set these in **Settings → Secrets and variables → Actions** on the repo:
+
+| Secret | Value |
+|---|---|
+| `KEYSTORE_BASE64` | `base64 -w0 release.jks` output |
+| `KEYSTORE_PASSWORD` | Keystore password |
+| `KEY_ALIAS` | Key alias inside the keystore |
+| `KEY_PASSWORD` | Key password |
+
+If secrets are absent the workflow falls back to a debug keystore so builds always succeed.

.github/workflows/release.yml

@@ -9,6 +9,10 @@ on:
 permissions:
   contents: write
 
+env:
+  # Opt into Node.js 24 for all actions before the June 2026 forced cutover.
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   build:
     name: Build & Release APK
@@ -48,9 +52,23 @@ jobs:
       - name: Build debug APK
         run: ./gradlew :presentation:assembleNoAnalyticsDebug
 
-      # If KEYSTORE_BASE64 secret is set, sign with the production keystore.
-      # Otherwise fall back to the Android debug keystore so the build
-      # never fails due to a missing production key.
+      # Ensure the Android debug keystore exists at ~/.android/debug.keystore
+      # before the release build. The debug APK step creates it automatically,
+      # but an explicit keytool call makes the path predictable and avoids
+      # the failure mode where ANDROID_HOME/debug.keystore (wrong path) is used.
+      - name: Ensure debug keystore exists
+        run: |
+          mkdir -p ~/.android
+          if [ ! -f ~/.android/debug.keystore ]; then
+            keytool -genkeypair -v \
+              -keystore ~/.android/debug.keystore \
+              -alias androiddebugkey \
+              -keyalg RSA -keysize 2048 \
+              -validity 10000 \
+              -storepass android -keypass android \
+              -dname "CN=Android Debug,O=Android,C=US"
+          fi
+
       - name: Build release APK
         run: |
           if [ -n "${{ secrets.KEYSTORE_BASE64 }}" ]; then
@@ -61,8 +79,10 @@ jobs:
               -Pandroid.injected.signing.key.alias="${{ secrets.KEY_ALIAS }}" \
               -Pandroid.injected.signing.key.password="${{ secrets.KEY_PASSWORD }}"
           else
+            # No production keystore configured — sign with the debug key.
+            # The keystore was guaranteed to exist by the step above.
             ./gradlew :presentation:assembleNoAnalyticsRelease \
-              -Pandroid.injected.signing.store.file="${ANDROID_HOME}/debug.keystore" \
+              -Pandroid.injected.signing.store.file="${HOME}/.android/debug.keystore" \
               -Pandroid.injected.signing.store.password=android \
               -Pandroid.injected.signing.key.alias=androiddebugkey \
               -Pandroid.injected.signing.key.password=android