fix(ci): scope manifest commit to avoid committing CI artifacts

Replace actions-js/push (which does git add .) with explicit git
commands that only stage manifest files. Add .gitignore entries for
vendor/bundle, .bundle, signing keys, and service account files.

Signed-off-by: Brandon McAnsh <git@bmcreations.dev>

Author: bmc08gt

.github/workflows/build-fcash2-upload-android.yml

@@ -119,11 +119,15 @@ jobs:
         run: bash scripts/update-release-manifest.sh
 
       - name: Commit & push manifest
-        uses: actions-js/push@master
-        with:
-          message: "build: update release manifest"
-          branch: "code/cash"
-          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add .well-known/release-manifest.json buildSrc/src/main/java/Packaging.kt
+          git diff --cached --quiet && echo "No changes to commit" && exit 0
+          git commit -m "build: update release manifest"
+          git push https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git HEAD:code/cash
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4

.gitignore

@@ -21,6 +21,17 @@ fastlane/report.xml
 *.env.*
 .claude/
 
+# Bundler (Ruby gems installed during CI)
+.bundle/
+vendor/bundle/
+
+# Signing keys decoded during CI
+key/
+apps/flipcash/app/key/
+
+# Service account keys
+serviceAccount.json
+
 # Maestro screenshot test artifacts
 maestro/screenshots/results/
 maestro/screenshots/diffs/