chore: upgrade to agp 9 and configure parallelism

[guzino]

Closes #1114
Refs #1113

This PR moves the build to the AGP 9.3.0 / Gradle 9.5.0 toolchain, replaces the internal AGP variant integrations with public artifact APIs, and declares task and Tooling API parallelism in the repo.

Description

Consumes the Kotlin 2.3.21 baseline landed in #1115 and touches AGP, Gradle, KSP and Hilt only. AGP 9 built-in Kotlin cannot compile Kotlin 2.2.21, which is why the language upgrade went first.

Artifact collection publishes copies and leaves AGP's own outputs untouched, instead of renaming in place the way the removed legacy variant hook did. Each copy task is registered as a finalizer of the artifact's final producer, so assemble and bundle emit them with no new task name for CI to call, and the bundle copy is taken after signing. The task types sit in the app build file rather than a separate build-logic project, matching the single-module layout.

The catalog keeps the Compose stability analyzer at the 0.7.5 selected in #1115. 0.8.0 pulls AGP 9.3.1 onto the plugin classpath, so the effective AGP would stop matching the pinned 9.3.0.

• Upgrades AGP to 9.3.0, the Gradle wrapper to 9.5.0, KSP to 2.3.10 and Hilt to 2.60.1.
• Removes the kotlin-android plugin and moves compiler configuration to the top-level Kotlin compiler-options DSL, keeping JVM 11 and the existing language flag.
• Enables the resValues build feature, since AGP 9 disables it by default and all three flavors set the app name through resValue.
• Drops android.nonFinalResIds=false, which AGP 9 deprecates with a default of true.
• Replaces the legacy buildConfigField declarations with the public variant API. The environment and local.properties reads become lazy providers, so they are tracked configuration-cache inputs instead of eager configuration-time reads.
• Replaces the removed internal output-renaming hooks with two tasks that listen to the public APK and bundle artifacts. Copies land in app/build/outputs/bitkit/<variant>/ under the established bitkit-{flavor}-{buildType}-{versionCode}-{abi}.apk and bitkit-{flavor}-{buildType}-{versionCode}.aab names, with the ABI and version code read from artifact metadata.
• Repoints just run, the E2E and release workflows, README.md and the release command doc at the collected outputs.
• Replaces kotlin("test") with an explicit kotlin-test-junit catalog entry. Built-in Kotlin does not inject the version or select the JUnit variant, and without this the whole test source set fails to compile.
• Declares the daemon, parallel, Tooling API parallel, caching and configuration-cache properties once each, which is what stops Android Studio regenerating a local gradle.properties diff on every sync.
• Leaves detekt at 1.23.8. It runs clean on Gradle 9.5.0 with no new findings.

One acceptance criterion is open. The release artifact, signature, symbol and checksum validation is unverified: the checked-in google-services.json has no to.bitkit client, so mainnet stops at the release Google Services task, and NDK 28.1.13356709 is not installed here. The dev release bundle covers the same collection path, and just release needs a run on a machine with both.

Preview

N/A

QA Notes

Manual Tests

• 1. Android Studio → open project: sync succeeds and leaves no local gradle.properties diff.
• 2. regression: Wallet → Send → Amount → Confirm: the dev build installed from the new output directory behaves as before.
• 3. regression: just run → dev app installs and launches on a device from app/build/outputs/bitkit/devDebug/.
• 4. just release on a machine with the mainnet google-services.json and NDK 28.1.13356709 → APK, AAB, native symbols, signatures and checksums all validate under the established names.
• 5. regression: release workflow run → publication picks up the collected APK and AAB and the build number parses from the file name (after merge).
• 6. regression: E2E workflow run → the universal APK glob resolves under the collected outputs (after merge).

Automated Checks

• Build contract added in BuildOutputContractTest.kt: asserts no internal or legacy AGP variant APIs and no kotlin-android plugin remain, both artifact listeners are wired, all nine generated BuildConfig fields are still declared per variant, the five parallelism properties appear exactly once, and every artifact consumer reads the collected outputs.
• NativeReleaseConfigTest.kt passes unchanged, so the native debug symbol paths and the release recipe are untouched.
• Local: just compile, just test, just lint and just build pass on the merged chore: update kotlin and compose bom #1115 baseline. detekt reports 11 findings, the same pre-existing set as master, none in the changed files.
• Generated BuildConfig was diffed for devDebug, tnetRelease and mainnetRelease against the AGP 8 baseline and every field matches, including the per-flavor network and the 16 locale tags. Environment overrides for the E2E, geo and Paykit flags still apply and invalidate the configuration cache.
• Artifact collection verified locally: assembleDevDebug emits all four bitkit-dev-debug-187-* APKs and bundleDevRelease emits bitkit-dev-release-187.aab, both alongside AGP's untouched default-named outputs. Deleting the collected directory and rebuilding recreates it.
• Toolchain verified locally: Gradle 9.5.0 on launcher JVM 17, effective AGP 9.3.0, build --dry-run resolves 426 tasks across all six variants, two consecutive runs reuse the configuration cache, and the only remaining deprecation is raised by detekt rather than this repo.
• Not run locally: just test android, local E2E, actionlint. The four edited workflows parse as YAML.
• CI: standard build, unit test and detekt checks run by the PR bot. This is a fork PR, so the run needs maintainer approval before the required checks report.

[ovitrif]

One blocking release issue remains: the bundle collector can leave stale versioned AABs eligible for checksum and publication, as reported by the Greptile review bot.

[ovitrif]

The PR description records that “the release artifact, signature, symbol and checksum validation is unverified” because “the checked-in google-services.json has no to.bitkit client.”

A local just release run I did at f04406e resolves that stated gap because it completes successfully with the mainnet google-services.json and the required NDK, producing the established versioned outputs:

• None of the four APK outputs has a missing or invalid signature.
• The AAB includes the required signature.
• The native-symbol ZIP contains no invalid entries.
• All eight expected Rust symbol libraries preserve .debug_info.
• Each of the six release artifacts has the required SHA-256 checksum.

The existing stale-AAB collector behavior still permits older versioned AABs to enter checksum and publication, so it remains the blocking review item.

[ovitrif]

Because AGP 9 removes applicationVariants, BaseVariantOutputImpl.outputFileName, and FinalizeBundleTask, this PR can no longer rename APKs and AABs inside AGP's output directories. Its replacement leaves AGP's app-* outputs unchanged and writes the established bitkit-* filenames as copies under app/build/outputs/bitkit/<variant>.

Please update synonymdev/bitkit-e2e-tests so scripts/build-android-apk.sh locates the universal APK produced by AGP 9 and continues writing aut/bitkit_e2e.apk or aut/bitkit_e2e_mainnet.apk. Its current bitkit-*-universal.apk lookup in app/build/outputs/apk/<flavor>/debug/ returns no file.

Please update synonymdev/bitkit-nightly so .github/workflows/mainnet-probe.yml locates the universal mainnet debug APK produced by AGP 9 and continues uploading probe-apk/bitkit_e2e.apk. Its current bitkit-mainnet-debug-*-universal.apk lookup in app/build/outputs/apk/mainnet/debug/ returns no file.

This compatibility work is tracked in #1128, now a sub-issue of the AGP 9 work in #1114. Please include the fix in this PR or in a stacked follow-up PR based on this PR, while preserving the established staged filenames.