fix(ci): client release-deploy 加 if 守卫,mac/ios 抖失败不阻发布

run 239:android/windows/macos 全绿、ios 在 Checkout 阶段 git fetch
git.51yanmei.com 走 frps 超时挂掉(非 iOS 构建问题;run 238 同代码 fetch 碰巧
成功)。因上一版把 build-ios 加进 release-deploy 的 needs,而 gitea 里
continue-on-error 的 job 失败**仍会 skip 下游 needs** → release-deploy 被跳过。

修:needs 保留四平台(等全部完成、不抢跑 → 收齐已上传产物),但加
`if: always() && needs.build-android.result == 'success'` —— 只要 android
(稳定 floor)成功即发布,mac/ios/windows 的瞬断失败不再 skip release-deploy,
download-artifact 收当时存在的产物照发。

yaml 校验通过。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A79VtQA1BwTuQN1ThpvYpo

.gitea/workflows/deploy-client.yml

@@ -90,25 +90,16 @@ jobs:
           name: windows
           path: dist/
 
-  # Why build-macos/build-ios don't block the working android+windows pipeline
-  # when Apple secrets aren't configured yet (they aren't, as of this writing):
-  #   1. release-deploy's `needs:` below is [build-android, build-windows]
-  #      ONLY — macOS/iOS are NOT dependencies, so release-deploy never waits
-  #      on them and never fails because of them.
-  #   2. `continue-on-error: true` on both jobs keeps the overall workflow-run
-  #      status green even while compile-macos.sh hard-fails (Apple Developer
-  #      ID / notary secrets absent — see its fail-fast checks) — that failure
-  #      is real signal ("go configure the secrets"), but it shouldn't read as
-  #      "the release pipeline is broken" when android+windows shipped fine.
-  #   3. compile-macos.sh's own default behavior is to hard-fail (not skip)
-  #      when its secrets are missing (macOS distribution must never ship
-  #      unsigned/unnotarized — see its header comment); compile-ios.sh's
-  #      default is to skip gracefully (exit 0) since an unconfigured iOS
-  #      account is a normal "not set up yet" state, not a defect. Either way
-  #      the job produces no dist/pangolin-macos-x64.zip, and
-  #      release-deploy's "Download all artifacts" step (no `name:` filter)
-  #      simply picks up whatever artifacts DO exist — an absent "macos"
-  #      artifact is not an error there.
+  # build-macos/build-ios 用 `continue-on-error: true` → 即便 Apple 侧构建抖了
+  # (frps 拉 sing-box 源码 / 公证超时等),也不阻塞 android+windows 发布:
+  #   1. release-deploy 现在 `needs:` 全部四个平台(见下),所以它会**等**全部
+  #      build 完成再发布 —— 避免旧 `needs: [build-android]` 只等 android、
+  #      macos/ios 还没传产物就发布导致漏平台的竞态。
+  #   2. continue-on-error 让 macos/ios 失败仍算「completed」满足 needs,不使整个
+  #      workflow 变红、不阻断已成功平台的发布;release-deploy 的「Download all
+  #      artifacts」(无 name 过滤)只捡实际存在的产物,缺某平台不报错。
+  #   3. Apple 签名 secret 现已在 gitea 用户级配齐(DEVELOPER_ID_P12/IOS_DIST_P12/
+  #      APPSTORE_API_* 等),macos/ios 正常应成功;continue-on-error 只是抖动兜底。
   build-macos:
     runs-on: mac
     continue-on-error: true
@@ -172,13 +163,24 @@ jobs:
       # No artifact upload — compile-ios.sh uploads straight to TestFlight via
       # altool (matches jiu); nothing is produced under dist/ for this job.
 
-  # release-deploy 只 needs build-android(唯一稳定可用的平台 floor)。windows/macos/ios
-  # best-effort:各自 runner+secret 就绪则上传 artifact,release-deploy flatten 收
-  # dist-raw/ 里"当时存在"的产物。windows 机离线 / Apple secret 未配 都不阻塞发版
-  # (对应平台下载保留 pangolin1 上一版,待可用时下个 client-v* 追上)。
+  # release-deploy 发布策略:needs 全部四平台(等它们**完成**,不抢跑),但用
+  # `if` 让 mac/ios/windows 的失败不 skip 本 job —— 只要 android(稳定 floor)成功即发。
+  # 背景:build-macos/ios 必须跑在 mac runner,其 Checkout(git fetch git.51yanmei.com)
+  # 走 frps 隧道偶发超时挂掉(run 239 的 ios 就是 fetch fdc13ea 超时,非 iOS 构建问题;
+  # run 238 同代码 fetch 碰巧成功)。这类瞬断不该阻断已成功平台的发布。
+  #   · needs 四平台 → download-artifact 收到当时**全部已上传**的产物(修旧
+  #     `needs:[build-android]` 只等 android、macos/ios 没传就发布漏平台的竞态)。
+  #   · continue-on-error 在 gitea 里**不**让下游 needs 在失败时继续(会 skip),故必须
+  #     配 `if: always() && needs.build-android.result=='success'` 才能「等全部、失败不阻」。
   release-deploy:
-    needs: [build-android]
-    runs-on: mac
+    needs: [build-android, build-windows, build-macos, build-ios]
+    if: ${{ always() && needs.build-android.result == 'success' }}
+    # ubuntu-latest = 家里 nas act_runner,与 gitea 同机/同网:Release → Forgejo 的
+    # API 调用走本地不过 frps 隧道(mac runner 走 git.51yanmei.com→frps→抖,curl 超时
+    # exit 28,3m3s=release_ensure 60s×3 重试耗尽)。deploy-server/deploy-site 同为
+    # ubuntu-latest,其 Forgejo release 步稳定通过(server 仅 13s)。此 job 全为网络/
+    # SSH 步骤(下载产物/传 Forgejo/SSH pangolin1/通知),无 mac 专属需求。
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4