CI: cap build resources so it can't starve the host

Container hard limits: --cpus=2 --memory=6g (Docker-enforced regardless of Gradle).
Gradle: -Xmx3g heap, --max-workers=2, no parallel project builds. Adjust the
--cpus/--memory to the server's size.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/build-apk.yml

@@ -22,6 +22,9 @@ jobs:
     # A purpose-built RN Android image (Android SDK + NDK + Node). Runner needs Docker.
     container:
       image: reactnativecommunity/react-native-android:latest
+      # Hard caps so the build can't starve the host: at most 2 CPUs and 6 GB RAM.
+      # Adjust to your box (e.g. --cpus=1 / --memory=4g on a smaller server).
+      options: --cpus=2 --memory=6g --memory-swap=6g
     steps:
       - uses: actions/checkout@v4
 
@@ -51,10 +54,16 @@ jobs:
           BBP_UPLOAD_STORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
           BBP_UPLOAD_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
           BBP_UPLOAD_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
-          # Force IPv4: the runner's container has no IPv6 route, so dl.google.com
-          # (Google Maven) is "Network is unreachable" over its default AAAA record.
-          GRADLE_OPTS: "-Djava.net.preferIPv4Stack=true -Dorg.gradle.jvmargs=-Djava.net.preferIPv4Stack=true"
-        run: ./gradlew :app:assembleRelease -PreactNativeArchitectures=arm64-v8a --no-daemon -Djava.net.preferIPv4Stack=true
+          # Force IPv4 (runner container has no IPv6 -> dl.google.com unreachable) and
+          # cap the build JVM heap so it stays within the container's memory limit.
+          GRADLE_OPTS: "-Xmx3g -XX:MaxMetaspaceSize=768m -Djava.net.preferIPv4Stack=true"
+        # --max-workers=2 + no parallel project builds => at most ~2 concurrent tasks,
+        # so gradle/kotlin/C++ compiles don't fan out across every core on the host.
+        run: >-
+          ./gradlew :app:assembleRelease
+          -PreactNativeArchitectures=arm64-v8a
+          --no-daemon --max-workers=2 -Dorg.gradle.parallel=false
+          -Djava.net.preferIPv4Stack=true
 
       # Self-contained publish via the Forgejo API (no external action to fetch).
       - name: Publish release + upload APK