fix: restore Signal v8.31.1 patch compatibility

[purpleempress]

Summary

• Repair Signal v8.31.1 import-context drift using source-generated patches, while retaining compatibility with the published v8.30.2 pin.
• Preserve upstream shared call-link/sticker-pack actions and biometric lifecycle changes; keep Vesper dynamic incoming colours, fixed outgoing resource colours, and removal of the MobileCoin payment-lock UI.
• Extend the existing artifact-only PR validator to test pinned and v8.31.1, preserving its pinned check name, same-repository guard, read-only permissions and independent matrix legs.
• Keep upstream.pin at v8.30.2. Candidate adoption/publication is a separate operation after this repair lands.

Verification

• Fresh materialisation and full :Signal-Android:assembleWebsiteProdRelease on v8.30.2 and v8.31.1; unsigned universal APK package/version and ZIP integrity verified.
• All 47 CI-selected Android tests pass on each release (seven suites, zero failures/errors/skips).
• All 55 Python tests pass; actionlint, shell syntax and whitespace checks pass.
• Post-build fresh trees match built trees exactly: v8.30.2 25d4b4a69dde3a11fa42f5f7f76b2a282d3f0955; v8.31.1 db34a2f18ff3b599e2925667c513ac18644c6f9e.
• Re-export preserves all 55 patch/overlay files byte-for-byte; all 29 original patch authors, dates, subjects and commit bodies/trailers preserved.
• Independent pre-push diff/security review and tooling rerun.
• Remote artifact-only PR matrix completed successfully: run 38066584179, Signal pinned release (job 114255347611) and Signal v8.31.1 (job 114255347785). Both unsigned universal APK artifacts uploaded. All check annotations reviewed: one existing upstream PushDecryptMessageJobEnvelopeMigration.java:14 missing-@Deprecated warning per leg, no errors.

Scope and release sequencing

Only eight wrapper files change; no generated worktree, signing material or pin advancement is included. Most patch 0001 churn is exported context changing to two lines; semantic changes are import anchors and moving receiver-specific link-preview colour handling into a narrowly matched source transform. Patch 0011 retains upstream biometric support but not the payment preference or authentication invocation.

Merging triggers the normal signed pinned build. Wait for that production run to finish before dispatching the v8.31.1 adoption build with advance_pin=true: the two concurrency groups share the same live manifest target. No production dispatch or publication is part of this PR validation.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T16:13:00.096511Z	156851b	PR opened
🔒 Security Review	✅ Completed 2026-10-10T16:14:41.212452Z	156851b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 156851bd8e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Run the source-color tests through pytest

This command silently runs zero tests because test_transform_source_colors.py only declares pytest functions and has no executable entry point; its -v argument is consequently ignored. Directly invoking the command exits successfully with no output, whereas pytest -q tools/test_transform_source_colors.py runs 10 tests. The same ineffective command was added to pull-request.yml, so neither CI workflow exercises this transform regression suite; invoke it through pytest or add a real test runner.

Useful? React with 👍 / 👎.