ci: consolidate android-omnibus deployments on external PRs

[prasden]

Context and motivation

• Addendum to ci: stop deployment noise for maintainers #3445

• Looking at Define AT_HWCAP* when <sys/auxv.h> hides them #3429 from an external contributor, there still remains "deployment" noise as android-omnibus runs its device-farm job as a 6-way build matrix, and each matrix job references an environment directly.

• GitHub creates a deployment object per job that references an environment, so those six jobs produce six deployment objects that show up on the PR timeline UI. This gets noisy on PRs from external contributors.

Description of changes

• This PR moves the environment reference outside of the matrix and into a new maintainer-approval job. The environment is declared once and used across jobs.

• On external contributor PRs, this will cut down the deployments on PRs from 7 to 2 per commit:

  • previously 6 for android + 1 for security review -> now 1 for android-omnibus + 1 for security-review

• External contributors will still need approval for any workflows to run on their PRs , and device-farm is gated behind the new maintainer-approval check.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.18%. Comparing base (2df1601) to head (862a7d2).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3447      +/-   ##
==========================================
+ Coverage   78.02%   78.18%   +0.16%     
==========================================
  Files         699      699              
  Lines      124589   124592       +3     
  Branches    17286    17290       +4     
==========================================
+ Hits        97209    97418     +209     
+ Misses      26512    26304     -208     
- Partials      868      870       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[justsmth]

Nit: This is not accurate:

Suggested change

	# It waits until a maintainer approves, so its token sits idle in the runner during that window.
	# Empty permissions strip that token to zero scopes, so the waiting job can never touch AWS or the repo.
	# the environment's required reviewers must approve before it -- and
	# therefore device-farm -- can start. It runs none of its own code, so
	# drop the inherited id-token/contents scopes.

[justsmth]

Nit: Add comment:

Suggested change

	needs: [authorization-check, maintainer-approval]
	# SECURITY: maintainer-approval carries the manual-approval environment
	# gate. Do not remove it from needs -- it is the only thing keeping
	# untrusted fork code from being checked out with AWS credentials in scope
	# on external PRs. Any new job in this workflow that checks out fork code
	# must depend on maintainer-approval as well.
	needs: [authorization-check, maintainer-approval]