Bootstrap native Kotlin Android app and shared UI hot reload

[deku2026]

The Mobile repository currently contains only its license. This adds a native Kotlin Android Hello World application, a shared Compose UI with JVM Hot Reload for development, and the repository setup needed to build, test and deliver Android independently.

The build uses JDK 21 and Java/Kotlin bytecode target 21, Kotlin 2.4.20, Gradle 9.7.1, AGP 9.4.0 and Compose Multiplatform 1.12.0. The Android module consumes io.github.arcforges:contracts-client:1.0.0-ci.25.1 from Maven Central, including real protobuf serialization and coroutine gRPC adapter tests. Android is the only product distribution; the JVM target is a development preview.

Every main push automatically versions and builds an unsigned candidate, requires Windows/Linux builds, unit tests, lint, JVM bytecode checks, emulator tests and security scans, then signs that same candidate and publishes APK/AAB assets, mapping and checksums to GitHub Releases. The persistent signing identity and main-only android-release environment are configured. Main requires the aggregate Verify check. PR/manual runs validate without publication. Google Play and production backend integration are outside this Hello World bootstrap.

Repository setup includes Apache-2.0 notices, gitignore/gitattributes/editor settings, local hooks, contribution/security documentation, issue/PR templates, CODEOWNERS, Dependabot, strict dependency locks/checksums, secret scanning, dependency review and Java/Kotlin, Python and Actions CodeQL. The Kotlin scanner uses the documented checksum-pinned upstream compatibility workaround already used by Contracts. SDK setup works on both runner shells; a fresh Gradle user home was used to complete metadata verification.

Validation:

• GitHub CI passed on a6239fc: Windows/Linux builds, all unit tests, lint, class major 65 checks, dependency/secret checks, all CodeQL configurations, Android device tests and aggregate Verify.
• Local Windows validation built debug/test APKs, the R8-minified release APK and AAB. Published Contracts success/error and Unicode serialization tests passed.
• API 36 emulator tests covered interaction, empty-name handling and Activity recreation. The minified release APK installed and launched successfully both locally and in CI.
• The local release helper signed APK/AAB with the persistent identity, verified signatures/certificate/hashes and installed/launched the signed APK.
• Shared UI Hot Reload was verified by changing and restoring text in the same process. Default automatic save/reload reported two successful reloads, zero failures, and the semantic tree confirmed each change.

Main-only publication remains to be exercised after merge. No physical-device, Play Console or production backend validation is claimed.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.