fix: harden updater, Android configuration and signed release delivery

[649472774]

Scope

Release infrastructure lane for the coordinated overnight upgrade. Version remains 0.1.33 / code 34; no main merge, device install, signing-key replacement, or GitHub Release publication is included.

• Align AGP 9.0.1 / Gradle 9.1.0 / built-in Kotlin and compiler plugins 2.2.10, compatible AndroidX/Compose dependencies, targetSdk 36, strict lint, WebKit and Compose test support. Preserve minSdk 31 and .debug application identity.
• Correct credential backup domains in cloud backup and device transfer; retain narrow private-cache FileProvider roots. Wire proxy readiness/error and the shared persisted model catalog through AppContainer.
• Make updates bounded and cancellable throughout body consumption, explicit about proxy/direct routing, SHA-256 verified, and atomically downloaded. Validate actual APK package/version/Android requirements/current signer identity before requesting installation. Keep cancel, retry, permission-return and installer-return states truthful; never auto-install after download.
• Preserve the recorded existing debug certificate. Make release scripts fail fast, require committed source, stage nothing, select real devices only on explicit installation, preserve prior APKs, and generate checksums/source provenance/rollback information. Label ephemeral CI artifacts as validation-only, not drop-in updates.
• Replace stale contributor/release guidance with the current Kotlin/serialization/storage architecture and operational contracts.

Integration dependencies

Owned checkpoints: 8a128d0 (shared configuration), 2922e70 (updater/DI), d037cb7 (signing/delivery/CI/docs).

This branch also adopts core-owned prerequisites without independent core edits:

Core original	Adopted equivalent
93aa260	cadd321
da66b99	c90f4d9
7371ff0	eaaaa48
9866149	39e4546

Integration should deduplicate these prerequisites and apply the owned checkpoints above. The stable DataStore 1.1.7 Windows/JVM rename regression is addressed with explicit real Okio-backed JVM fixtures, not skipped assertions or a production dependency downgrade. Native production-factory/real-Keystore fixtures are retained.

Evidence and remaining acceptance

• Full combined JVM suite: 124 tests, 0 failures/errors/skips.
• assembleDebug, assembleDebugAndroidTest, strict lintDebug: passed; lint has 0 errors.
• Release PowerShell guards, native-tool parsing, backup domains, FileProvider roots, and CI YAML/provenance Python syntax checked.
• End-to-end committed-source release.ps1 -SkipBump -SkipInstall -SkipCopy: passed and produced a local bundle; no deployment or publication occurred.
• Local APK certificate SHA-256: 89dbef99c2c81eb48b0bf28dd698631ffcdf8ad7cbb4dac9960914096e68928b (matches recorded published/local baseline).
• Local candidate APK SHA-256: 69f2830283b81fefbdd036212da34a25855370ad3f5f598f5fb7604244b1ea2c.

Integration owns device execution and milestone publication. Seven isolated Android cases are ready: 3 APK archive rejection cases, 2 large-font cancellable update-dialog cases, and 2 core real-backend credential migration cases. No live account testing is claimed.