ci: release only for v* tags or manual runs; CI on main; Android SDK packages

- main is the long-lived development branch: release.yml no longer runs on
  a push to it, only on v* tags and workflow_dispatch. ci.yml now runs on
  every branch push, main included.
- android-actions/setup-android's default package list includes `tools`,
  which current command-line tools no longer carry, so sdkmanager failed;
  install exactly platform-tools, android-35 and build-tools 35.0.1.
- reader-chrome.test.ts left its React roots mounted; a scheduled commit
  could land after jsdom teardown and fail the run with an unhandled
  "Right-hand side of 'instanceof' is not an object" (all tests passing).
  Unmount in afterEach.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -1,14 +1,14 @@
 # Build and test: server (Node/TypeScript), web client, UI review, Android shell.
 #
-# Runs on pull requests and on pushes to any branch except main. Pushes to main and
-# release tags run it through release.yml (workflow_call), before any image is
-# published, so main is tested exactly once per push.
+# Runs on pull requests and on pushes to every branch, main included (main is the
+# long-lived development branch). Release tags and manual releases run it through
+# release.yml (workflow_call) before any image is published.
 name: CI
 
 on:
   pull_request:
   push:
-    branches-ignore: [main]
+    branches: ['**']
   workflow_call:
   workflow_dispatch:
 
@@ -112,9 +112,12 @@ jobs:
           distribution: temurin
           java-version: 17
           cache: gradle
-      # The hosted runner ships the Android SDK; this only accepts and adds what the
-      # build asks for (platform 35, build-tools 35.0.1).
+      # The hosted runner ships the Android SDK; this accepts the licences and adds
+      # exactly what the build asks for. The action's default package list includes
+      # `tools`, which current command-line tools no longer carry (sdkmanager fails).
       - uses: android-actions/setup-android@v3
+        with:
+          packages: platform-tools platforms;android-35 build-tools;35.0.1
       - run: ./gradlew --no-daemon :app:assembleDebug
         working-directory: android
       - uses: actions/upload-artifact@v4

.github/workflows/release.yml

@@ -1,8 +1,10 @@
 # Release the single-container image (server + web) to Docker Hub for amd64 and arm64.
 #
-#   push to main      -> hectorqin/reader-pro:main, :sha-<short>
 #   tag v1.2.3        -> hectorqin/reader-pro:1.2.3, :1.2, :latest, :sha-<short>
-#   manual run        -> tags for the chosen ref, as above
+#   manual run        -> the chosen branch's name (e.g. :main) and :sha-<short>
+#
+# Never on a plain push: main is the long-lived development branch, and a release
+# is a decision (a tag, or "Run workflow" in the Actions tab), not a side effect.
 #
 # CI (ci.yml) runs first; nothing is published from a red build. Each architecture
 # is built on its own native runner — the arm64 image under QEMU would run npm ci
@@ -15,7 +17,6 @@ name: Release
 
 on:
   push:
-    branches: [main]
     tags: ['v*']
   workflow_dispatch: