ci: give Android Lint its own job instead of tuning memory a third time

test-and-build-android has now died with "the runner has received a shutdown
signal" seven times in this workflow's history — SIGTERM, exit 143, the OOM
killer taking the runner agent on a 16GB box. Twice on this PR alone: 2cd6569f
at 35 minutes during compileFdroidDebugKotlin, f5fc432e at 29.5 minutes during
testFdroidDebugUnitTest. Neither had a failing test; the job is simply killed,
which is why the report steps come back "skipped" rather than red.

Two attempts to fix this by changing numbers are already spent, and the existing
comments in this file record both. Capping both daemons to 4g traded the runner
OOM for an R8/lintAnalyze "java.lang.OutOfMemoryError: Java heap space" — those
draw on the Gradle daemon's heap and 4g is not enough for them here. Dropping to
--max-workers=3 survives a warm cache but still dies on a cold one, which is the
case that matters: a PR touching quartz or commons invalidates the read-only
cache the PR runs restore, so they rebuild from cold at 2-3x the main-branch
time. Every commit on this PR touches commons.

So this is the structural fix rather than a third number. lintAnalyze is the
single heaviest step in that job — 13 of the 35 minutes on the 2cd6569f run —
and it holds a large analysis graph while the Kotlin daemon, a forked test JVM
and R8 are still resident. Moving the two lint tasks to their own runner removes
that peak from the critical job instead of trying to squeeze everything under
one ceiling, and the two now run concurrently rather than in series.

The cost is real and worth stating: both jobs restore the same read-only Gradle
cache and therefore repeat some module compilation. That trade is favourable
because the duplicated work is parallel while the memory pressure was not.

Nothing about the tasks themselves changes — same task names, same daemon caps,
same --max-workers. The lint-report artifact upload moves to the new job.

Not verified locally: lintPlayBenchmark is a 13-minute task on CI hardware and
this container is the same shape as the runner that keeps dying, so running it
here would prove nothing useful. What is checked is that the workflow still
parses, that lint-android carries needs: lint like its sibling, and that the
android job no longer references the lint tasks. CI is the test for this one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AXvKXakvup4inNFfAhhr4L

.github/workflows/build.yml

@@ -335,6 +335,62 @@ jobs:
           name: Quartz iOS Test Reports
           path: quartz/build/reports
 
+  # Android Lint, split out of test-and-build-android.
+  #
+  # That job died with "the runner has received a shutdown signal" (SIGTERM,
+  # exit 143) seven times across this workflow's history — the OOM killer taking
+  # the runner agent on a 16GB box. Two attempts to fix it by tuning numbers
+  # have now been spent: capping both daemons to 4g traded the runner OOM for an
+  # R8/lintAnalyze "Java heap space", and --max-workers=3 survives a warm cache
+  # but still dies on a cold one.
+  #
+  # This is the structural fix rather than a third number. lintAnalyze is the
+  # single heaviest step in that job — measured at 13 of its 35 minutes on one
+  # cold run — and it holds a large analysis graph while the Kotlin daemon, a
+  # forked test JVM and R8 are all still resident. Giving the two lint tasks
+  # their own runner removes that peak from the critical job instead of trying
+  # to squeeze everything under one ceiling, and the two now run concurrently.
+  #
+  # The cost is honest: both jobs restore the same read-only Gradle cache and so
+  # repeat some module compilation. That buys back more than it spends here,
+  # because the duplicated work is parallel while the memory pressure was not.
+  lint-android:
+    needs: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v6.0.0
+        with:
+          distribution: 'temurin'
+          java-version: 21
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+
+      # Same daemon cap as the sibling job: lintAnalyze draws on the Gradle
+      # daemon's heap, which is why the earlier 4g experiment broke it. Only the
+      # Kotlin daemon is trimmed.
+      - name: Lint Android (gradle)
+        run: |
+          ./gradlew \
+            -Dkotlin.daemon.jvmargs="-Xmx4g -XX:MaxMetaspaceSize=1g" \
+            --max-workers=3 \
+            :amethyst:lintFdroidBenchmark \
+            :amethyst:lintPlayBenchmark
+
+      - name: Upload Android Lint Reports
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: Android Lint Reports
+          path: amethyst/build/reports/lint-results-*.html
+
   test-and-build-android:
     needs: lint
     runs-on: ubuntu-latest
@@ -363,12 +419,15 @@ jobs:
         with:
           cache-read-only: ${{ github.ref != 'refs/heads/main' }}
 
-      # Lint + focused unit tests + benchmark assembly in one Gradle invocation.
-      # Previously: one invocation for lint, one for `test` (which compiled all
-      # six amethyst variants × all flavors), one for `assembleBenchmark`
-      # (re-walking the same task graph). Combining them keeps the daemon hot
-      # across phases and lets task-level dedup (e.g. compileKotlin) only
-      # happen once.
+      # Focused unit tests + benchmark assembly in one Gradle invocation.
+      # Previously: one invocation for `test` (which compiled all six amethyst
+      # variants × all flavors) and one for `assembleBenchmark` (re-walking the
+      # same task graph). Combining them keeps the daemon hot across phases and
+      # lets task-level dedup (e.g. compileKotlin) only happen once.
+      #
+      # Lint used to run here too and now has its own job (lint-android above) —
+      # see the note there for why. What remains is still the heaviest job in
+      # the workflow, so the memory notes below continue to apply.
       #
       # `-PdisableAbiSplits=true` produces a single non-split APK per
       # (flavor, buildType) instead of 5 (4 ABIs + universal). The CI only
@@ -421,8 +480,6 @@ jobs:
           ./gradlew \
             -Dkotlin.daemon.jvmargs="-Xmx4g -XX:MaxMetaspaceSize=1g" \
             --max-workers=3 \
-            :amethyst:lintFdroidBenchmark \
-            :amethyst:lintPlayBenchmark \
             :quartz:jvmTest \
             :commons:jvmTest \
             :commonsUI:jvmTest \
@@ -433,13 +490,6 @@ jobs:
             :amethyst:assembleBenchmark \
             -PdisableAbiSplits=true
 
-      - name: Upload Android Lint Reports
-        uses: actions/upload-artifact@v7
-        if: always()
-        with:
-          name: Android Lint Reports
-          path: amethyst/build/reports/lint-results-*.html
-
       # Publishes the JUnit XML produced by the unit-test tasks above as inline
       # annotations plus a job summary. Replaces asadmansr/android-test-report-action,
       # which was abandoned (last release 2020) and rebuilt an EOL Ubuntu 18.04 +