build: limit Bouncy Castle alignment to -jdk18on modules

The resolution rule also rewrote the legacy -jdk15on artifacts that
metalava's tooling depends on to 1.86, a version that line never had
(it ended at 1.70), so metalavaCheckCompatibilityRelease failed to
resolve in CI. Only align the -jdk18on modules the app ships.

Add the metalava check to the pre-commit command in AGENTS.md so local
runs cover the same tasks as CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 8 insertions, 4 deletions

diff --git a/AGENTS.md b/AGENTS.md
index a94a484d..3fa60b0c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -38,7 +38,8 @@ Needs JDK 17 and the Android SDK. `local.properties` (gitignored) holds `sdk.dir
 Prefix with `CI=1` to match CI: it turns Kotlin warnings into errors, so a deprecation warning
 that passes locally fails CI. Before committing, run:
 
-    CI=1 ./gradlew spotlessCheck test -PslimTests assembleFreeDebug assembleFreeRelease lintFreeRelease
+    CI=1 ./gradlew spotlessCheck test -PslimTests assembleFreeDebug assembleFreeRelease \
+      lintFreeRelease metalavaCheckCompatibilityRelease
 
 Flavors: `free` (no proprietary dependencies, Sentry replaced by `sentry-stub`) and `nonFree`
 (adds Sentry and Play Services SMS OTP).
diff --git a/build.gradle.kts b/build.gradle.kts
index 150e3566..8820dcab 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -9,12 +9,15 @@ plugins {
   id("com.github.android-password-store.versions")
 }
 
-// Keep every Bouncy Castle module (bcprov, bcpg, bcpkix, bcutil) on one version. They are
-// pulled in by PGPainless and sshj at different versions, and mixing them is unsupported.
+// Keep every Bouncy Castle -jdk18on module (bcprov, bcpg, bcpkix, bcutil) on one version. They
+// are pulled in by PGPainless and sshj at different versions, and mixing them is unsupported.
+// The legacy -jdk15on artifacts (build tooling only) stopped at 1.70 and must be left alone.
 subprojects {
   configurations.configureEach {
     resolutionStrategy.eachDependency {
-      if (requested.group == "org.bouncycastle") useVersion(libs.versions.bouncycastle.get())
+      if (requested.group == "org.bouncycastle" && requested.name.endsWith("-jdk18on")) {
+        useVersion(libs.versions.bouncycastle.get())
+      }
     }
   }
 }