ci: drop the dry-run failure notifier and run it monthly

Reverts the tracking-issue job from 601088b: a single maintainer watching
the Actions tab doesn't need a bot filing issues at them, and GitHub
already emails on scheduled workflow failure.

Also moves the heartbeat from weekly to monthly. Nothing it watches --
cert expiry, secret rotation, dependency drift -- moves on a weekly
timescale, and a dispatch run before cutting a release is the check that
actually matters.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/release-dryrun.yml

@@ -7,10 +7,10 @@ name: Release dry-run
 on:
   # Run on demand before cutting a release.
   workflow_dispatch:
-  # Weekly heartbeat so cert expiry, secret rotation, and dependency drift
+  # Monthly heartbeat so cert expiry, secret rotation, and dependency drift
   # surface on their own between releases.
   schedule:
-    - cron: '0 9 * * 1' # Mondays 09:00 UTC
+    - cron: '0 9 1 * *' # 1st of the month, 09:00 UTC
 # Setup environment variables for use in all jobs.
 env:
   # Gemfile path used for caching dependencies.
@@ -124,50 +124,3 @@ jobs:
       # fully signed archive without uploading to the App Store.
       - name: Sign and build with fastlane (no publish)
         run: cd ios && bundle exec fastlane release dry_run:true
-
-  # A heartbeat nobody reads is worse than none: it reads as green by default.
-  # This one broke on the release after 5.1.0 and stayed broken for weeks
-  # without surfacing, so scheduled failures now open a tracking issue and
-  # comment on it each week it stays red. Only on `schedule` — a failed
-  # workflow_dispatch is already in front of whoever pressed the button.
-  notify:
-    name: Report scheduled failure
-    needs: [android, ios]
-    if: failure() && github.event_name == 'schedule'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - name: Open or update the tracking issue
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          LABEL: release-dryrun
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-
-          # Idempotent: `gh issue create --label` fails outright if the label
-          # is missing, and it won't exist on the first failure.
-          gh label create "$LABEL" \
-            --color B60205 \
-            --description "Automated: the weekly release dry-run is failing" \
-            2>/dev/null || true
-
-          existing=$(gh issue list --state open --label "$LABEL" --limit 1 \
-            --json number --jq '.[0].number // empty')
-
-          if [ -n "$existing" ]; then
-            gh issue comment "$existing" --body \
-              "Still failing as of $(date -u +%Y-%m-%d). $RUN_URL"
-          else
-            gh issue create \
-              --title "Release dry-run is failing" \
-              --label "$LABEL" \
-              --body "$(printf '%s\n' \
-                "The weekly release dry-run failed: $RUN_URL" \
-                "" \
-                "This checks the release pipeline between releases — Play and App Store credentials, signing certs and provisioning profiles, and that a release build still validates against both stores. A failure here means the next release is likely to fail too, so it's worth fixing before cutting one." \
-                "" \
-                "Closing this issue is fine once the run is green; a later failure opens a new one.")"
-          fi