build: update to Gradle 9.8.2, AGP 9.5.0, Kotlin 2.4.21, Hilt 2.60.1

AGP 9 migration:
- Configure the shared Android setup through the new DSL
  (CommonExtension, ApplicationExtension) instead of the removed
  TestedExtension and BaseAppModuleExtension; targetSdk moves to the
  application extension.
- Stop applying the Kotlin Android plugin; AGP 9 compiles Kotlin itself.
- Replace kapt with KSP 2.3.13 for Hilt, which built-in Kotlin requires,
  and carry the Dagger compiler options over as KSP arguments.
- AGP 9 now applies packaging excludes to unit-test resources, which
  stripped the diceware word list (**/*.txt) from its tests; lift that
  exclude in the diceware module.
- Use resources.directories instead of the deprecated srcDir.

Plugin updates required by Gradle 9 / AGP 9: Sentry Gradle plugin
6.25.0 (sentry-android 8.62.0), metalava plugin 0.5.1, maven-publish
0.37.0, spotless 8.10.4, version-catalog-update 1.1.2, download task
5.7.0, foojay resolver 1.0.0, with their API changes. Newer metalava
models Kotlin properties, so autofill-parser/api.txt is regenerated;
the diff is representation only, no API was added or removed.

Fix new Kotlin 2.4 and lint findings (explicit return type in a
function with an early return, UseKtx in autofill-parser), drop
deprecated Kotlin Gradle properties, and make the AGENTS.md pre-commit
command cover every task CI runs (both flavors, lint on all modules).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 7 insertions, 2 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 3fa60b0c..e1ed9d1b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -33,13 +33,13 @@ Needs JDK 17 and the Android SDK. `local.properties` (gitignored) holds `sdk.dir
     ./gradlew assembleFreeDebug                 # debug APK
     ./gradlew test -PslimTests                  # unit tests, as CI runs them
     ./gradlew spotlessApply                     # formatting (ktfmt); CI runs spotlessCheck
-    ./gradlew lintFreeRelease
+    ./gradlew lint                              # all modules and variants, as CI runs it
 
 Prefix with `CI=1` to match CI: it turns Kotlin warnings into errors, so a deprecation warning
 that passes locally fails CI. Before committing, run:
 
     CI=1 ./gradlew spotlessCheck test -PslimTests assembleFreeDebug assembleFreeRelease \
-      lintFreeRelease metalavaCheckCompatibilityRelease
+      assembleNonFreeDebug assembleNonFreeRelease lint metalavaCheckCompatibilityRelease
 
 Flavors: `free` (no proprietary dependencies, Sentry replaced by `sentry-stub`) and `nonFree`
 (adds Sentry and Play Services SMS OTP).
@@ -63,6 +63,11 @@ itself, so it cannot be referenced with a local `./` path.
   and hash included. A dependency bump that moves a baselined jar needs the path updated.
 - `LaunchActivity` is exported and forwards `FILE_PATH` to `DecryptActivity` (not exported)
   only after `isFileInRepo` checks it canonically resolves inside the store.
+- AGP 9 applies packaging excludes (`AndroidCommon`, e.g. `**/*.txt`) to unit-test java
+  resources as well. A module whose tests load such a file must remove the exclude locally
+  (see `passgen/diceware/build.gradle.kts`).
+- Hilt runs through KSP (no kapt; AGP 9's built-in Kotlin does not support it). Dagger compiler
+  options are `ksp { arg(...) }` in `app/build.gradle.kts`.
 - JGit is pinned at 4.5.7 (2019). Newer JGit needs Java 11 APIs Android only partly desugars;
   upgrading it is a large, separate job.