ci: let wallet APK releases build mobile, cold, or both

[illuzen]

@@ -0,0 +1,13 @@

Summary

• Wallet APK workflow now lets you pick mobile, cold, or both; each selected app builds in parallel and can publish its own public GitHub Release (wallet-v… / cold-wallet-v…).
• Shared build lives in .github/workflows/build_wallet_apk.yml so a cold-wallet failure does not block a mobile release (and vice versa).
• Fixes the mobile release APK failure: pre-install nightly Rust (rust-src + Android targets) before flutter build apk so two Gradle cargokit tasks stop racing rustup toolchain install nightly.

Test plan

• Merge to a branch GitHub Actions can run, then Actions → Create Wallet Android Build → Run workflow
• apps=mobile, build_mode=release, create_release=false — signed APK artifact quantus_wallet-android-release uploads; no GitHub Release
• apps=cold, build_mode=release, create_release=false — signed APK artifact quantus_cold_wallet-android-release uploads
• apps=both, build_mode=debug — both debug APKs upload; no signing/release jobs
• apps=mobile (or both) with create_release=true — public release tagged wallet-v{mobile-app pubspec version} with the APK attached
• Confirm the Rust/cargokit step no longer fails on rustup toolchain install nightly / “could not rename downloaded file”
• Confirm cold wallet reuses the existing ANDROID_* signing secrets (same keystore as mobile)

[n13]

APPROVE — no blocking findings.

The reusable build preserves the caller commit, validates the app choice, produces distinct mobile/cold artifacts and tag namespaces, and installs the nightly Android toolchain before Gradle can start parallel cargokit tasks. Each release job depends only on its matching build, so a failure in one app does not prevent the other app's release path. The signing-file locations also match both Android projects.

Validation:

• actionlint .github/workflows/build_wallet_apk.yml .github/workflows/create_wallet_android_build.yml — passed
• YAML parse of both changed workflows — passed
• git diff --check d9e0d39f8b50a221f87245683c3b6008197dc326...1b39de5efacf10e17d5b5829ae6e765ad600b72c — passed
• Repository Analyze check — passed at the reviewed head

An actual manual APK workflow run remains pending because the new workflow_dispatch definition is not on the default branch until merge; static inspection found no blocking issue in that path.