Fix the build notification, and stop it crying wolf

Run 4 built both apps successfully and then emailed to say the build had FAILED.
Two separate faults.

The notification step died on bash 3.2, which macOS still ships as /bin/bash. It
mis-parses a heredoc inside command substitution when the text contains an
apostrophe: the word "anyone's" was enough to produce "unexpected EOF while
looking for matching '". Reproduced on the ingest Mac before and after the fix.
The body is written to a file first, which avoids the construct entirely.

The failure alert was then sent because it keyed off failure() for the whole job,
so a bug in the success notification presented as a broken build. It is now scoped
to steps.build.outcome, so it reports only what it claims to report.

An alert that fires when nothing is wrong trains you to ignore it, which costs more
than the missing alert it replaced.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/build-apps.yml

@@ -37,6 +37,7 @@ jobs:
     runs-on: macos
     steps:
       - name: Build both apps
+        id: build
         run: |
           set -eu
           export PATH="/usr/local/bin:/opt/homebrew/bin:$PATH"
@@ -97,15 +98,17 @@ jobs:
         run: |
           export PATH="/usr/local/bin:$PATH"
           cd "$HOME/checklist-app"
-          V="$(node -e 'const c=require("./mobile/release.config.json");console.log(`${c.version} (ios build ${c.iosBuild}, android code ${c.androidVersionCode})`)')"
-          # The body is built with a heredoc rather than a bare multi-line argument: an
-          # argument that starts at column 0 ends the YAML block scalar and makes this whole
-          # file unparseable, which Gitea reports only by silently never running it.
-          BODY="$(cat <<MSG
+          V="$(node -e 'const c=require("./mobile/release.config.json");console.log(c.version+" (ios build "+c.iosBuild+", android code "+c.androidVersionCode+")")')"
+          # The body goes to a file first. It must NOT be built with $(cat <<EOF ...): macOS
+          # ships bash 3.2, which mis-parses a heredoc inside command substitution as soon as
+          # the text contains an apostrophe — the word "anyone's" alone was enough to fail the
+          # step with "unexpected EOF while looking for matching '".
+          BODY_FILE="$(mktemp -t checklist-alert)"
+          cat > "$BODY_FILE" <<MSG
           A change landed that the iOS and Android apps bundle, so they were rebuilt on the
           ingest Mac. Both built cleanly and are signed and ready.
 
-          They are NOT on anyone's phone yet, and will not be until you ship them:
+          They are NOT on any phone yet, and will not be until you ship them:
 
               cd ~/Documents/recurring-checklist-app
               ./release.sh --ios --android
@@ -115,15 +118,19 @@ jobs:
           The website already has this change — it deploys on push. Only the apps, which
           carry their own copy of the UI, are waiting.
           MSG
-          )"
-          node scripts/alert.js "Apps rebuilt and waiting — shipped versions are now behind" "$BODY" || true
+          node scripts/alert.js "Apps rebuilt and waiting — shipped versions are now behind" "$(cat "$BODY_FILE")" || true
+          rm -f "$BODY_FILE"
 
       - name: Tell Christian the build broke
-        if: failure()
+        # Scoped to the build step, not the whole job. Previously any failure here sent "the
+        # build FAILED" — including a bug in the notification step itself, which is exactly
+        # what happened on run 4: both apps built fine and the email said they had not.
+        if: failure() && steps.build.outcome == 'failure'
         run: |
           export PATH="/usr/local/bin:$PATH"
           cd "$HOME/checklist-app"
-          BODY="$(cat <<MSG
+          BODY_FILE="$(mktemp -t checklist-alert)"
+          cat > "$BODY_FILE" <<MSG
           A push changed something the apps bundle, and the rebuild did not compile.
 
           The website is unaffected — it deploys separately and is already live with this
@@ -132,5 +139,5 @@ jobs:
           Full log:
           http://chronicles-ab.waterschurch.org:3000/christian/recurring-checklist/actions
           MSG
-          )"
-          node scripts/alert.js "App build FAILED on the ingest Mac" "$BODY" || true
+          node scripts/alert.js "App build FAILED on the ingest Mac" "$(cat "$BODY_FILE")" || true
+          rm -f "$BODY_FILE"