CI hardening: fast-fail check job (lockfile/tsc/eslint) gates the APK build + optional ntfy alerts; config plugin makes 'expo prebuild' preserve release signing/versioning; node 22 pinned with docker lock script + pre-push hook

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -5,7 +5,36 @@ on:
     branches: [main]
 
 jobs:
+  check:
+    # Fast fail: lockfile sync, types, lint — catches in ~2 min what would
+    # otherwise kill the APK build twenty minutes in.
+    runs-on: desktop
+    container:
+      image: node:22
+    steps:
+      - name: Checkout
+        run: |
+          git init -q .
+          git fetch -q --depth 1 "https://git.rehbock.xyz/${{ github.repository }}.git" "${{ github.sha }}"
+          git checkout -q FETCH_HEAD
+      - name: Lockfile + typecheck + lint
+        run: |
+          cd app
+          npm ci --no-audit --no-fund
+          npx tsc --noEmit
+          npx eslint .
+      - name: Notify failure
+        if: failure()
+        env:
+          NTFY_TOKEN: ${{ secrets.NTFY_TOKEN }}
+        run: |
+          [ -n "$NTFY_TOKEN" ] || { echo "NTFY_TOKEN not set — skipping notification"; exit 0; }
+          curl -s -H "Authorization: Bearer $NTFY_TOKEN" -H "Title: gtd CI: check failed" -H "Priority: high" \
+            -d "typecheck/lint/lockfile failed at ${{ github.sha }} — https://git.rehbock.xyz/marcus/gtd/actions" \
+            https://ntfy.rehbock.xyz/gtd-ci
+
   build:
+    needs: check
     # RN/NDK builds starve the 4-core VPS — run on the desktop runner
     # (marcusDesktop). Jobs queue while the desktop is off and start when it
     # comes online; switch back to ubuntu-latest to build on the VPS.
@@ -81,3 +110,13 @@ jobs:
             -H "Authorization: token $TOKEN" \
             -F "attachment=@$APK;type=application/vnd.android.package-archive" >/dev/null
           echo "published $TAG"
+
+      - name: Notify failure
+        if: failure()
+        env:
+          NTFY_TOKEN: ${{ secrets.NTFY_TOKEN }}
+        run: |
+          [ -n "$NTFY_TOKEN" ] || { echo "NTFY_TOKEN not set — skipping notification"; exit 0; }
+          curl -s -H "Authorization: Bearer $NTFY_TOKEN" -H "Title: gtd CI: APK build failed" -H "Priority: high" \
+            -d "release build failed at ${{ github.sha }} — https://git.rehbock.xyz/marcus/gtd/actions" \
+            https://ntfy.rehbock.xyz/gtd-ci