fix(ci): make release workflow tag-only safe

[ceastld]

Summary

• keep Release execution guarded to tag refs matching the existing v*.. trigger
• remove invalid direct secret usage from the release step condition
• let release builds continue without signing secrets so Gradle uses the debug-signing fallback
• treat blank signing environment variables as missing in Gradle so optional signing fallback values still apply

Testing

• PR CI: green (CI / build on run 32349444584)
• Verified with gh run list that the PR branch produced only CI pull_request runs and no Release run on the non-tag push/PR
• Verified gh workflow view release.yml --ref cursor/fix-release-workflow-9efb --yaml can read the fixed Release workflow
• Local Gradle build attempted, but this cloud VM has no Android SDK configured (ANDROID_HOME/local.properties missing)