ci: prebuild WDA runners and publish to Cloudflare R2

[Timo972]

What

Adds .github/workflows/prebuild-r2.yml, which builds the prebuilt WebDriverAgentRunner artifacts and mirrors them to Cloudflare R2 under releases/mobilerun-wda/, following the droidrun-ios release/preview pattern — plus a latest/ folder that always points at the newest tagged release.

Trigger	R2 destination
release: published	releases/mobilerun-wda/<tag>/ and releases/mobilerun-wda/latest/ (+ attached to the GitHub Release)
push to master	releases/mobilerun-wda/preview/
workflow_dispatch	preview/ when run from master, build-only otherwise

Builds the full six-variant set (same as the old wda-package.yml): iOS + tvOS, real device + simulator (arm64 & x86_64). Each folder also gets SHA256SUMS and BUILD_INFO.txt (commit, ref, build date). Artifact file names are kept stable so consumers get predictable URLs, e.g. …/releases/mobilerun-wda/latest/WebDriverAgentRunner-Runner.zip.

Why

WDA artifacts were only ever produced as throwaway GitHub Actions artifacts via the manual wda-package.yml — no R2, no versioning. mobilerun consumes a prebuilt runner, so we need versioned + latest + preview artifacts in R2, matching how mobilerun-ios is published.

Notes

• Tunnel fix: the job checks out submodules: recursive and builds HevSocks5Tunnel.xcframework (via Scripts/build-hev-socks5-tunnel.sh) before the iOS runner build, because WebDriverAgentRunner now links the WebDriverAgentTunnel appex. tvOS rows skip this (they don't link the tunnel). The removed wda-package.yml did neither and was already broken on this line.
• Unsigned: builds use CODE_SIGNING_ALLOWED=NO (existing Scripts/ci/build-*.sh); the runner is signed at install time. No Apple secrets needed.
• No Scripts/* changes — build-real.sh, build-sim.sh, and build-hev-socks5-tunnel.sh are reused as-is.
• Removes wda-package.yml — superseded; its manual-build use case is covered by workflow_dispatch here.
• Not triggered on PRs (six macOS Xcode builds is too costly); PRs are already covered by wda-tests.yml / functional-test.yml / unit-test.yml.

Required before this works

Add in repo Settings → Secrets and variables → Actions (point at the same bucket as mobilerun-ios):

• Secrets: R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY
• Variable: R2_BUCKET

The upload steps will fail until these are configured.

Verification plan

1. workflow_dispatch from this branch → confirm all six zips build green (proves the submodule + tunnel-xcframework fix).
2. Merge → confirm preview/ populates.
3. Publish a test pre-release tag (e.g. v0.0.0-test) → confirm <tag>/ + latest/ populate; re-tag confirms latest/ is overwritten but old <tag>/ is preserved. Spot-check a zip contains PlugIns/WebDriverAgentTunnel.appex.

🤖 Generated with Claude Code