Package the Rust mobile core and generated Kotlin API for Android (#92)

DEPENDENCIES.md

@@ -31,7 +31,7 @@ The current direct dependencies are:
 | [regex 1.13](https://crates.io/crates/regex/1.13.1) | Linear-time byte-oriented decrypted grep matching | MIT OR Apache-2.0 |
 | [tempfile 3](https://crates.io/crates/tempfile) | Permission-restricted CLI editor session directories and cleanup | MIT OR Apache-2.0 |
 | [Serde 1](https://crates.io/crates/serde), [TOML 0.9](https://crates.io/crates/toml), [shlex 1.3](https://crates.io/crates/shlex), [url 2.5](https://crates.io/crates/url) | Strict configuration and command values | MIT OR Apache-2.0 |
-| [UniFFI 0.32](https://crates.io/crates/uniffi/0.32.0) | Swift bridge | MPL-2.0 |
+| [UniFFI 0.32](https://crates.io/crates/uniffi/0.32.0) | Swift and Kotlin bridge | MPL-2.0 |
 | [zeroize 1.9](https://crates.io/crates/zeroize/1.9.0) | Clear decrypted bytes on drop | MIT OR Apache-2.0 |
 
 The activated transitive graph has no dependency that forces a GPL or LGPL
@@ -115,4 +115,16 @@ version catalog pins stable AndroidX, Kotlin, Hilt/KSP and formatting tools.
 Espresso 3.7.0 is pinned explicitly because Compose's older transitive Espresso
 cannot initialize input injection on API 37. AndroidX Test is Apache-2.0;
 JUnit 4.13.2 is EPL-1.0 and test-only. ktlint and its Gradle plugin are MIT,
-build-only tools. Native runtime dependency/ABI review belongs to #92.
+build-only tools.
+
+#92 packages [JNA 5.19.1](https://repo.maven.apache.org/maven2/net/java/dev/jna/jna/5.19.1/jna-5.19.1.pom)
+as the Android AAR under its Apache-2.0 option (dual-licensed with LGPL-2.1-or-later).
+It is the OS FFI runtime required by generated UniFFI Kotlin, not a competing
+storage implementation. Its Android native libraries are subject to the same
+three-ABI, ELF and 16 KB APK alignment checks as Rust. Exact resolved AAR/POM
+checksums and locks are committed. cargo-ndk 4.1.2 (MIT OR Apache-2.0) is build-only;
+NDK 30.0.16248370 and Rust 1.97.1 are pinned and checked. The build-only ELF/ZIP
+auditor reuses locked object 0.36.7 (Apache-2.0 OR MIT) and zip 2.4.2 (MIT)
+versions already present in the workspace. UniFFI's MPL-2.0 source remains available
+at its recorded upstream crate version. Release attribution assembly is owned by
+#112; the dependency policy and runtime matrix are in android/README.md.