fix(ci): unbreak mobile preview CD against eas-cli 22

[rynfar]

Mobile preview CD failed with Cannot read properties of undefined (reading 'ownerAccount') — after its EAS builds had already succeeded, so the job went red on a step that only posts a PR comment.

Cause

eas-cli 22 renamed the build JSON fields (project → app, channel → updateChannel, runtimeVersion → runtime). continuous-deploy-fingerprint still does:

const { project } = build;
`/accounts/${project.ownerAccount.name}/projects/${project.slug}/builds/${build.id}`

build.project is now undefined. Tracked upstream as expo/expo-github-action#358, still open. The workflow asked for eas-version: latest, so it installed the breakage on its own.

Fix

Pins eas-version: 21.8.0 — the last release before the rename — for this workflow only. The production workflow calls eas directly, never runs this action, and stays on latest. The pin carries the issue link and the condition to lift it.

Also pins the action to @v9. It was the only action reference in the repository tracking an unreleased branch, so CI behaviour could change with no commit here. Worth noting continuous-deploy-fingerprint does not exist in v8, which is why the setup action beside it is a different major.

Documentation

apps/mobile/README.md gains the mobile build path, because two failure modes in this area are silent and both cost real time this week:

• EAS build servers read the EAS-hosted environment, never the checkout. eas build archives with git, so a gitignored .env/.env.local reaches nothing.
• Missing PYLON_EAS_PROJECT_ID ships a binary with updates.enabled: false. It installs and runs normally but can never receive an OTA — discovered only after a full rebuild cycle.
• Missing Clerk/relay values omit every Connect surface with no error and no empty state.

Adds a command to verify a finished artifact instead of assuming, plus device-install and OTA runtime-version notes (an update published under fingerprint never lands on an appVersion build).

Verification

• Both workflow files parse; eas-version and both action refs confirmed in the parsed YAML
• continuous-deploy-fingerprint confirmed absent at v8, present at v9 and main
• eas-cli@21.8.0 confirmed as the last 21.x release
• Not exercised end to end: that needs a labelled PR, and the label is intentionally off fix(mobile): Pylon Connect reaches mobile builds #37 to avoid queueing builds

Stacks cleanly with #37, which touches different hunks of the same workflow.

Model: Claude Opus 5. Harness: Claude Code.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for 396ae12.

This comment will update automatically after the next completed run.