ci(client): mac/iOS 证书 env 映射到全局通用短名密钥

Apple 证书/公证密钥是账号级、跨项目唯一 → 放全局(用户级)密钥用通用短名
(DEVELOPER_ID_P12/P12_PASSWORD/IOS_DIST_P12/IOS_DIST_PASSWORD/APPSTORE_*),
workflow env 里把脚本期望的长名映射过去,脚本不动。描述文件(与 bundle id 绑定)
仍走项目级。修此前 build-macos/ios 因密钥名对不上取不到证书。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

.gitea/workflows/deploy-client.yml

@@ -28,7 +28,9 @@ on:
 
 concurrency:
   group: deploy-client
-  cancel-in-progress: false
+  # true:新 client-v* 取消仍在跑的旧发版(如 windows 机离线导致 build-windows 无限排队
+  # 卡住的旧 run),让最新版顺利发布,避免并发组被僵尸 run 占死。
+  cancel-in-progress: true
 
 jobs:
   build-android:
@@ -107,8 +109,11 @@ jobs:
 
       - name: Compile (macOS System Extension app)
         env:
-          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }}
-          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }}
+          # 左=脚本期望的 env 名(勿改),右=实际密钥名。Apple 证书/公证密钥是
+          # 账号级、跨项目唯一 → 放【全局(用户级)密钥】用通用短名,pangolin/jiu 各自
+          # 在此映射到自己脚本的 env。Developer ID Application 证书=站外分发,一张签所有 app。
+          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.DEVELOPER_ID_P12 }}
+          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.P12_PASSWORD }}
           MACOS_APP_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_APP_PROVISION_PROFILE_BASE64 }}
           MACOS_SYSEXT_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_SYSEXT_PROVISION_PROFILE_BASE64 }}
           APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
@@ -135,8 +140,10 @@ jobs:
 
       - name: Compile & upload to TestFlight (iOS)
         env:
-          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_CERT_P12_BASE64 }}
-          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
+          # 证书=账号级 →【全局】通用短名(Apple Distribution 证书,签 iOS App Store/TestFlight);
+          # 描述文件=与 bundle id 绑定 →【项目级】pangolin 仓库密钥。
+          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_P12 }}
+          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_PASSWORD }}
           IOS_APP_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_APP_PROVISIONING_PROFILE_BASE64 }}
           IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64 }}
           APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
@@ -147,8 +154,12 @@ jobs:
       # No artifact upload — compile-ios.sh uploads straight to TestFlight via
       # altool (matches jiu); nothing is produced under dist/ for this job.
 
+  # release-deploy 只 needs build-android(唯一稳定可用的平台 floor)。windows/macos/ios
+  # best-effort:各自 runner+secret 就绪则上传 artifact,release-deploy flatten 收
+  # dist-raw/ 里"当时存在"的产物。windows 机离线 / Apple secret 未配 都不阻塞发版
+  # (对应平台下载保留 pangolin1 上一版,待可用时下个 client-v* 追上)。
   release-deploy:
-    needs: [build-android, build-windows]
+    needs: [build-android]
     runs-on: mac
     steps:
       - name: Checkout

client/android/app/build.gradle

@@ -84,6 +84,17 @@ flutter {
     source '../..'
 }
 
+// url_launcher(6.3.x)的 android 实现拉入 androidx.core:1.17 / androidx.browser:1.9,
+// 二者要求 AGP 8.9.1+,而本项目工具链是 AGP 8.6.0(升级 AGP 会牵动 libbox 原生构建,风险大)。
+// 打开 URL 用不到这些新版 API → 强制降到兼容 AGP 8.6 的版本,构建通过、功能不受影响。
+configurations.all {
+    resolutionStrategy {
+        force 'androidx.core:core:1.13.1'
+        force 'androidx.core:core-ktx:1.13.1'
+        force 'androidx.browser:browser:1.8.0'
+    }
+}
+
 dependencies {
     // ── sing-box libbox（gomobile AAR）──────────────────────────────
     // 产物(gitignore,清掉/换 worktree 都要重建)二选一,均产 io.nekohasekai.libbox 包: