chore(deps): AGP currency — 9.2.1 is three stable releases behind (9.3.2 available)

[DocGerd]

Priority: P3

Context

gradle/libs.versions.toml:2 pins AGP 9.2.1. Stable 9.3.0, 9.3.1, and 9.3.2 have all shipped — the repo is three stable releases behind.

Surfaced while triaging the 2026-08 Dependabot alert wave.

Explicitly NOT a security lever

Worth stating up front so nobody re-derives it: upgrading AGP does not fix any currently open alert.

• BouncyCastle ([security · medium] Manifest hardening: taskAffinity, NSC, data_extraction_rules, perms comment #33, security(deps): force BouncyCastle 1.85 on :app configs AND the root buildscript classpath (2 critical alerts) #291): apkzlib 9.3.2 still declares bcprov/bcpkix 1.79 — verified by fetching the POM. No stable AGP fixes it.
• Netty ([security · low] CI workflow hardening: permissions block + explicit release flags #35–v1.1 (1/3): Non-food OFF-miss fallback chain (Beauty/PetFood/Products) #44, security(deps): bump UTP Netty resolution pin 4.1.135.Final → 4.1.137.Final (10 open alerts) #290): no stable AGP yet ships UTP with a patched Netty transitive; the resolution pin remains the only lever.

This is a plain currency/maintenance ticket, not a security one.

Why it is still worth doing

• Falling further behind makes each eventual upgrade larger and riskier.
• AGP upgrades are the mechanism by which the netty and BouncyCastle resolution pins eventually get to be deleted — both pins carry an explicit drop-condition tied to a future AGP. Staying current is how those drop-conditions get evaluated.
• AGP/Kotlin/KSP versions are lockstepped; drifting on one constrains the others.

Risk

Non-trivial for this repo — AGP upgrades touch the areas with the most documented footguns:

• Lint: new checks arrive at error severity. The LocalContextGetResourceValueCall trap that broke feat(i18n): externalize Compose UI strings + German translation (#168) #217 came in this way.
• Screenshot goldens: the 11 Robolectric @GraphicsMode(NATIVE) goldens are byte-exact and host-non-portable. If a toolchain change moves any pixel, regeneration must go through CI (screenshot-goldens-actual artifact) — never a locally-rendered golden. Scope carefully first: grep the screenshot-test sources for the affected roles before assuming a full 11-golden regen.
• UTP / instrumented tests: the androidTest job is a required check and is where UTP changes actually surface.
• Dependency lock: app/gradle.lockfile will likely move; that diff is expected here (unlike in the pin PRs, where a byte-identical lockfile is the proof nothing shipped changed).
• Signing: verify apksigner verify --print-certs still reports the lifetime cert ec9a4bb8…b3d9.

Proposed approach

1. Own branch, own PR — do not bundle with security(deps): bump UTP Netty resolution pin 4.1.135.Final → 4.1.137.Final (10 open alerts) #290 / security(deps): force BouncyCastle 1.85 on :app configs AND the root buildscript classpath (2 critical alerts) #291, whose acceptance criteria depend on a byte-identical lockfile.
2. Bump AGP in gradle/libs.versions.toml; check whether Kotlin/KSP need to move in lockstep (note security(accept-risk): kotlin-gradle-plugin GHSA-r937-wjx7-w2jp has no compatible stable fix (alert #45) #292: a Kotlin bump has its own constraints).
3. Regenerate the lockfile; review the diff deliberately.
4. Full local gate: assembleDebug, testDebugUnitTest, lintDebug, detekt, assembleRelease + apksigner verify.
5. Emulator connectedDebugAndroidTest, or rely on the required androidTest CI check.
6. Re-evaluate the drop-conditions on the netty and BouncyCastle pins — if 9.3.x happens to ship patched transitives, delete the corresponding pin block in the same PR.

Acceptance criteria

• AGP on the latest stable 9.3.x
• build + androidTest green
• apksigner verify --print-certs reports ec9a4bb8…b3d9 unchanged
• Any newly-firing lint checks fixed at root cause (not suppressed)
• Screenshot goldens regenerated through CI if and only if genuinely staled
• Netty + BouncyCastle pin drop-conditions re-evaluated and the outcome noted

Related: #290, #291.