Scaffold native Android build and enforce Rust boundaries (#89)

DEPENDENCIES.md

@@ -108,3 +108,11 @@ version pinning and update gates are recorded in
 [`docs/android/architecture.md`](docs/android/architecture.md#approved-dependencies-and-review-policy).
 The Gradle catalog and resolved dependency/license records must identify actual
 shipped versions before release; this approval matrix does not replace that audit.
+
+The #89 scaffold records exact resolved build/test artifacts in
+`android/gradle/verification-metadata.xml` and module Gradle lockfiles. The
+version catalog pins stable AndroidX, Kotlin, Hilt/KSP and formatting tools.
+Espresso 3.7.0 is pinned explicitly because Compose's older transitive Espresso
+cannot initialize input injection on API 37. AndroidX Test is Apache-2.0;
+JUnit 4.13.2 is EPL-1.0 and test-only. ktlint and its Gradle plugin are MIT,
+build-only tools. Native runtime dependency/ABI review belongs to #92.