Complete Android parity and security audit (#111)

docs/android/architecture.md

@@ -80,7 +80,7 @@ At #89 pin a mutually supported stable AGP/Gradle/Kotlin/KSP/Hilt set, JDK,
 SDK build tools and NDK, plus wrapper checksum. The current [AGP 9.4 contract](https://developer.android.com/build/releases/agp-9-4-0-release-notes)
 requires Gradle 9.6.0 and JDK 17 and supports API 37. This is a candidate build
 baseline, subject to actual artifact availability and plugin compatibility.
-The #89 scaffold pins AGP 9.4.1, Gradle 9.8.1, Kotlin 2.4.20, KSP 2.3.12,
+The #89 scaffold pins AGP 9.4.1, Gradle 9.8.1, Kotlin 2.4.21, KSP 2.3.12,
 Hilt 2.60.1 and JDK 25 (JVM output 17); its catalog and build instructions live
 in [android/README.md](../../android/README.md). These pins are verified by the
 scaffold build gates rather than inferred from minimum-version requirements.
@@ -198,9 +198,11 @@ a remote clone. Do not seed app data or commit credentials to prove recovery.
 ## Verification and acceptance
 
 The [parity matrix](parity.md) assigns every current non-Watch mobile capability
-and every Android issue to a Rust owner and Android API. Its pending rows are
-implementation obligations, not accepted gaps. #111 must replace pending status
-with evidence and have no unexplained gap before #112 distribution.
+and every Android issue to a Rust owner, current Android component and executable
+checks. The [#111 audit](audit.md) records current results, runtime limits and the
+unpatched/deprecated upstream dependency findings tracked outside this milestone
+in [#125](https://git.rfc1437.de/hugo/IronStorage/issues/125). This traceability does
+not claim that cargo-audit is clean or grant unrestricted release approval.
 
 Every issue runs the AGENTS.md Rust gates before commit. Android changes also
 run build/lint/unit/instrumented checks appropriate to the issue and computer-use