Scope dependency-scan to shipping deps and make it blocking

[kisst]

Problem

The dependency-scan job was silently failing on every push. The overall CI run reported success only because the job was marked continue-on-error: true, so the red X was permanent noise.

Root cause: the job dumped the entire Gradle dependency graph (all configurations, 282 packages) into a synthetic pom.xml and fed it to OSV-scanner, which exits non-zero on any CVE. The 39 CVEs found (netty, logback, protobuf, commons-io) all live in build/test-only configurations:

Config	What it is	Ships in APK?
ktlint	linter's own classpath	❌ no
testRuntimeOnly	test runtime (AGP Unified Test Platform)	❌ no

None reach releaseRuntimeClasspath — the shipping closure is clean AndroidX/Kotlin/OkHttp.

Fix

Scope the scan to only what actually ships:

• :app + :unshorten → releaseRuntimeClasspath
• :core (JVM lib) → runtimeClasspath

Closure drops 282 → 106 packages. Since the scan is now meaningful, the job is flipped from warn-only to blocking — it goes red only when a genuinely shipped dependency gets a CVE.

Verification

• Scoped closure contains 0 of the offending packages
• Ran the real OSV-scanner v2.3.8 Docker image locally against the generated pom → No issues found, exit 0
• actionlint on the workflow → clean