infra: normalize prebuild merge jobs (***REMOVED***1678)

Align the nine prebuilds-*.yml merge jobs on a single canonical shape
(`runs-on: ubuntu-latest`, `needs: prebuild`, `permissions: contents: write`,
named "Download all build artifacts" / "Upload merged artifacts" steps using
the same pinned action SHAs). Specific drift fixes:

- prebuilds-qvac-lib-infer-nmtcpp.yml: pin runner to ubuntu-latest (was
  ubuntu-24.04), add contents: write, name the artifact steps.
- prebuilds-qvac-lib-infer-whispercpp.yml: add contents: write.
- prebuilds-qvac-lib-infer-onnx-tts.yml: drop the dead `environment: release`
  on the merge job; no step in that job reads a release-scoped secret (the
  matching prebuild job keeps `environment: release` for S3 model downloads).
- prebuilds-qvac-lib-infer-onnx.yml and prebuilds-ocr-onnx.yml: reorder job
  keys and drop the `Replicate android artifacts` step. Bare's current
  prebuild resolver no longer needs the android-arm / android-ia32 /
  android-x64 duplicates of android-arm64.
- prebuilds-qvac-lib-infer-llamacpp-embed.yml: drop a stray blank line
  inside the merge job.

prebuilds-ocr-onnx.yml still keeps `environment: release`, `id-token: write`,
and its extra actions/checkout + setup-aws-prebuild + `aws s3 cp` OCR model
download + `models` artifact upload after the shared merge block; that
behavior is unchanged.

Co-authored-by: olyasir <sirkinolya@gmail.com>

Author: jpgaribotti

.github/workflows/prebuilds-ocr-onnx.yml

@@ -258,11 +258,11 @@ jobs:
 
   merge:
     runs-on: ubuntu-latest
+    needs: prebuild
     environment: release
     permissions:
       contents: write
       id-token: write
-    needs: prebuild
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd ***REMOVED*** 6.0.2
@@ -277,13 +277,6 @@ jobs:
           path: prebuilds
           merge-multiple: true
 
-      - name: Replicate android artifacts
-        run: |
-          mkdir -p prebuilds/android-arm prebuilds/android-ia32 prebuilds/android-x64
-          cp -rv prebuilds/android-arm64/* prebuilds/android-arm/
-          cp -rv prebuilds/android-arm64/* prebuilds/android-x64/
-          cp -rv prebuilds/android-arm64/* prebuilds/android-ia32/
-
       - name: Upload merged artifacts
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f ***REMOVED*** 7.0.0
         with:

.github/workflows/prebuilds-qvac-lib-infer-llamacpp-embed.yml

@@ -290,7 +290,6 @@ jobs:
     needs: prebuild
     permissions:
       contents: write
-
     steps:
       - name: Download all build artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c ***REMOVED*** 8.0.1

.github/workflows/prebuilds-qvac-lib-infer-nmtcpp.yml

@@ -568,15 +568,19 @@ jobs:
           path: ${{ env.PKG_DIR }}/prebuilds/*
 
   merge:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs: prebuild
+    permissions:
+      contents: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c ***REMOVED*** 8.0.1
+      - name: Download all build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c ***REMOVED*** 8.0.1
         with:
           path: prebuilds
           merge-multiple: true
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f ***REMOVED*** 7.0.0
+      - name: Upload merged artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f ***REMOVED*** 7.0.0
         with:
           name: prebuilds
           path: prebuilds

.github/workflows/prebuilds-qvac-lib-infer-onnx-tts.yml

@@ -352,7 +352,6 @@ jobs:
 
   merge:
     runs-on: ubuntu-latest
-    environment: release
     needs: prebuild
     permissions:
       contents: write
@@ -369,4 +368,3 @@ jobs:
           name: prebuilds
           path: prebuilds
 
-

.github/workflows/prebuilds-qvac-lib-infer-onnx.yml

@@ -262,23 +262,16 @@ jobs:
 
   merge:
     runs-on: ubuntu-latest
+    needs: prebuild
     permissions:
       contents: write
-    needs: prebuild
     steps:
       - name: Download all build artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c ***REMOVED*** 8.0.1
         with:
           path: prebuilds
           merge-multiple: true
 
-      - name: Replicate android artifacts
-        run: |
-          mkdir -p prebuilds/android-arm prebuilds/android-ia32 prebuilds/android-x64
-          cp -rv prebuilds/android-arm64/* prebuilds/android-arm/
-          cp -rv prebuilds/android-arm64/* prebuilds/android-x64/
-          cp -rv prebuilds/android-arm64/* prebuilds/android-ia32/
-
       - name: Upload merged artifacts
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f ***REMOVED*** 7.0.0
         with:

.github/workflows/prebuilds-qvac-lib-infer-whispercpp.yml

@@ -279,6 +279,8 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     needs: prebuild
+    permissions:
+      contents: write
     steps:
       - name: Download all build artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c ***REMOVED*** 8.0.1