Define native Android architecture and parity contract (#88)

DEPENDENCIES.md

@@ -100,3 +100,11 @@ The checked-in compatibility suite completes the earlier OpenPGP backend gate:
 `pgp` imports protected armored and binary exports, decrypts every GnuPG-audited
 fixture, emits independently decryptable single- and multi-recipient messages,
 and verifies the detached recipient signatures.
+
+## Android dependency policy
+
+The approved Android library/API purposes, license review, maintenance checks,
+version pinning and update gates are recorded in
+[`docs/android/architecture.md`](docs/android/architecture.md#approved-dependencies-and-review-policy).
+The Gradle catalog and resolved dependency/license records must identify actual
+shipped versions before release; this approval matrix does not replace that audit.