ci: speed up gradle jobs (cache + assembleDebug for PRs)

The two slowest CI jobs were both Gradle:
  lint     6m41s (Android lint = 264s of it)
  lsposed  6m44s (assembleRelease = 307s of it)
Cargo was already cached; Gradle was not.

Changes:

  - gradle/actions/setup-gradle@v6 in lint and lsposed jobs. Caches
    ~/.gradle/caches, wrapper, configuration cache. cache-read-only on
    PRs so only main pushes write it.
  - lint job now has a cargo cache too (was missing). Combined key for
    both Cargo.lock files.
  - lint: Android lint and Kotlin unit tests run in one Gradle
    invocation (./gradlew :app:lint :app:testDebugUnitTest). Saves a
    second Gobley/AGP configuration phase + JVM startup.
  - lsposed: assembleDebug for PRs and main pushes, assembleRelease only
    for v* tags. R8/ProGuard runs only when the artifact actually goes
    into a release.
  - Drop --no-daemon: with one invocation per job (or one warm daemon
    between two), keeping the daemon is cheaper than killing it.
  - Drop the manual `export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME"`. The
    CI image's Dockerfile already sets ANDROID_NDK_ROOT (line 63), so
    the workaround is redundant.

.github/workflows/ci.yml

@@ -38,6 +38,28 @@ jobs:
       - name: Mark workspace safe
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
+      # Cache cargo deps + target dirs for clippy/test. Same key shape as
+      # zygisk + lsposed jobs — when those run on the same Cargo.lock the
+      # restore-keys fallback shares warm artifacts across jobs.
+      - name: Cache cargo
+        uses: actions/cache@v5
+        with:
+          path: |
+            /usr/local/cargo/registry
+            /usr/local/cargo/git
+            zygisk/target
+            lsposed/native/target
+          key: cargo-${{ runner.os }}-lint-${{ hashFiles('zygisk/Cargo.lock', 'lsposed/native/Cargo.lock') }}
+          restore-keys: cargo-${{ runner.os }}-lint-
+
+      # Gradle cache (deps + configuration cache + wrapper). cache-read-only
+      # on PRs so only main pushes write — keeps the cache from churning on
+      # every PR's branch-scoped key.
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: ${{ github.event_name == 'pull_request' }}
+
       # Codegen
       - name: Verify generated iface lists are up to date
         run: |
@@ -74,17 +96,12 @@ jobs:
       # Kotlin
       - name: ktlint
         run: ktlint "lsposed/**/*.kt"
-      # Gobley's cargo plugin reads ANDROID_NDK_ROOT (not _HOME) to find the
-      # NDK at gradle configure time. The CI image only sets _HOME; export
-      # _ROOT here until the next image rebuild bakes it in.
-      - name: Android lint
-        run: |
-          export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME"
-          cd lsposed && ./gradlew --no-daemon :app:lint
-      - name: Kotlin unit tests
-        run: |
-          export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME"
-          cd lsposed && ./gradlew --no-daemon :app:testDebugUnitTest
+      # Single Gradle invocation: lint + tests share one configuration
+      # phase + warm daemon. Configures Gobley's cargo plugin once instead
+      # of twice. ANDROID_NDK_ROOT is baked into the CI image
+      # (Dockerfile ENV), no manual export needed.
+      - name: Android lint + Kotlin unit tests
+        run: cd lsposed && ./gradlew :app:lint :app:testDebugUnitTest
 
   kmod:
     runs-on: ubuntu-latest
@@ -191,6 +208,13 @@ jobs:
           key: cargo-${{ runner.os }}-lsposed-${{ hashFiles('lsposed/native/Cargo.lock') }}
           restore-keys: cargo-${{ runner.os }}-lsposed-
 
+      # Gradle cache (deps + configuration cache + wrapper). cache-read-only
+      # on PRs so only main pushes write the cache.
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: ${{ github.event_name == 'pull_request' }}
+
       - name: Set up keystore
         env:
           KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
@@ -218,14 +242,19 @@ jobs:
           storeFile=$KEYSTORE_PATH
           EOF
 
-      # Gobley's cargo plugin reads ANDROID_NDK_ROOT (not _HOME) to find the
-      # NDK at gradle configure time. The CI image only sets _HOME; export
-      # _ROOT here until the next image rebuild bakes it in.
+      # Release tags get the full assembleRelease (R8/ProGuard, signed APK
+      # ready for the GitHub release). PRs and main pushes get assembleDebug
+      # — same code paths exercised, no R8 step (~1.5–2 min faster).
       - name: Build APK
         run: |
-          export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME"
-          cd "$GITHUB_WORKSPACE/lsposed" && ./gradlew --no-daemon assembleRelease
-          cp app/build/outputs/apk/release/app-release.apk "$GITHUB_WORKSPACE/vpnhide.apk"
+          cd "$GITHUB_WORKSPACE/lsposed"
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            ./gradlew assembleRelease
+            cp app/build/outputs/apk/release/app-release.apk "$GITHUB_WORKSPACE/vpnhide.apk"
+          else
+            ./gradlew assembleDebug
+            cp app/build/outputs/apk/debug/app-debug.apk "$GITHUB_WORKSPACE/vpnhide.apk"
+          fi
 
       - name: Upload artifact
         uses: actions/upload-artifact@v7