fix(android): harden origin isolation and native file lifecycles

Block cross-origin POSTs, preserve bounded generated exports without relaxing CSP, bind picker results to their initiating context, erase camera cache and constrain platform permissions. Upgrade vulnerable build/test tooling and lock runtime/build dependencies. JVM regressions, lint and unsigned release builds pass; extended emulator validation remains separate.

android/build.gradle.kts

@@ -1,8 +1,28 @@
-plugins {
-    id("com.android.application") version "8.13.2" apply false
-    id("org.jetbrains.kotlin.android") version "2.2.10" apply false
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+    }
+    // Override AGP's bundled KGP to include CVE-2026-53914 remediation.
+    dependencies { classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.21") }
+    configurations.getByName("classpath").resolutionStrategy {
+        activateDependencyLocking()
+        eachDependency {
+            when (requested.group) {
+                "io.netty" -> useVersion("4.1.139.Final")
+                "com.google.protobuf" -> useVersion("3.25.9")
+                "org.bouncycastle" -> useVersion("1.86")
+                "org.apache.commons" -> if (requested.name == "commons-lang3") useVersion("3.21.0")
+                "org.apache.httpcomponents" -> if (requested.name == "httpclient") useVersion("4.5.14")
+                "org.bitbucket.b_c" -> if (requested.name == "jose4j") useVersion("0.9.6")
+                "org.jdom" -> if (requested.name == "jdom2") useVersion("2.0.6.1")
+            }
+        }
+    }
 }
 
+plugins { id("com.android.application") version "9.4.1" apply false }
+
 // WSL mounted Windows volumes may reject Gradle's POSIX file metadata operations.
 // Opt-in external output root; ordinary developer/CI builds retain standard paths.
 val outputRoot = providers.environmentVariable("YUVOMI_BUILD_DIR")