fix(nav): keep NavKey classes so screen-root test tags survive R8

[bmc08gt]

Screen-root test tags come out wrong on a minified build, so the Maestro smoke suite can only run unminified.

annotatedEntry derives each screen's root test tag from T::class.simpleName (NavMetadata.screenRootTag). getSimpleName() on a nested class reads the InnerClasses attribute, and R8 emits that attribute only for classes matched by a full -keep. The two rules this replaces were -keepnames, which preserves the binary name but not the attribute, so AppRoute.Main.Scanner reported AppRoute$Main$Scanner and its tag came out as app_route$main$scanner_screen. The global -keepattributes InnerClasses that Retrofit's bundled rules pull in does not change that.

They also never matched com.flipcash.app.core.onboarding.OnboardingStep, which reaches NavKey through FlowStep rather than AppRoute. Those classes were obfuscated outright, so the seed screen reported n69_screen. That case is also why reading the binary name in Kotlin instead would not have worked.

-keep class * implements androidx.navigation3.runtime.NavKey

Matching on the NavKey supertype covers both hierarchies and any future one. Class-only, with no member wildcard, so members stay shrinkable and renameable. It costs +137 classes retained and +16 KB of APK against the current baseline; for scale, #1370 removed 568 classes and 25,542 live methods.

On a minified debug build (DEBUG_MINIFY=true, which leaves UI_TESTABLE true), a uiautomator dump reports wallet_screen and scanner_screen, both nested under AppRoute.Main. In the same APK's dex, OnboardingStep$SeedInput carries InnerClass name="SeedInput" — the member getSimpleName() reads.

Only builds with BuildConfig.UI_TESTABLE true expose testTags as resource-ids, so a stock release never showed these tags and nothing user-facing changes. What this buys is Maestro running against a minified build.

The second commit makes CI do that. .github/workflows/maestro.yml never set DEBUG_MINIFY, so the suite only ever ran unminified and a keep-rule regression would have gone green. It now comes from a matrix entry defaulting to true, which is what the nightly run gets. A minify dispatch input takes true, false, or both; both expands to a two-entry matrix through a small setup job, since a matrix cannot be built from an input inline. max-parallel: 1, because every flow signs into the same shared test account, and the report artifact is named per variant.

A third commit makes the failure name itself. An unset credential was not an error anywhere — cred() returned an empty string, Maestro got an empty -e value, inputText: ${SEED_PHRASE} typed nothing, and the run failed on wallet_screen is visible inside a login subflow that names none of the cause. That is why the nightly job has failed on all 25 runs since it was added: the MAESTRO_* secrets it maps do not exist, so each expands to "". run.sh now checks the credentials before touching the device — a missing SEED_PHRASE or LOGIN_DEEPLINK stops the run, the flow-specific ones warn and name the flows that read them, and neither prints a value. It also fixes seed_contact dying silently when pipefail turns a no-match grep into a failed assignment, and adds the LOGIN_USERNAME mapping the workflow was missing.

Creating the secrets is separate from this PR; the nightly stays red until they exist.