fix(app): align Firebase plugins for SwiftPM

[arhxam]

What changed and why

Align firebase_crashlytics with the repository's firebase_core 3.13 family and remove the temporary Flutter Swift Package Manager opt-out. A contract test locks the compatible plugin set so the skew cannot silently return.

Closes #11676

Product invariants affected

none

How it was verified

• flutter pub get --enforce-lockfile — resolved the checked-in lockfile without changes.
• flutter test test/unit/flutterfire_spm_contract_test.dart — the aligned Firebase versions and enabled SPM contract passed.
• Inspected the resolved firebase_auth, firebase_messaging, and firebase_crashlytics plugin manifests — each now requires the firebase_core 3.13 family.
• bash scripts/analyze_ratchet.sh — analyzer ratchet passed.
• pod install, then flutter build ipa --release --flavor dev --no-codesign — Flutter added SwiftPM integration and resolved the native graph successfully, including Firebase iOS SDK 11.15.0 plus aligned firebase_core 3.13.0, firebase_auth 5.5.3, firebase_crashlytics 4.3.5, and firebase_messaging 15.2.5. No Firebase/SwiftPM version conflict occurred.
• Xcode reached the archive action but this machine lacks the watchOS 26.2 platform required by the scheme's embedded Watch app. The remaining failure is watchOS 26.2 must be installed in order to archive the scheme, not package resolution or compilation skew. A signed maintainer/Codemagic archive is still the final acceptance gate.

Tests

• Added a regression contract for the Firebase version family and SPM opt-out removal.
• Resolved dependencies from the committed lockfile and checked the native plugin compatibility family.
• Generated the CocoaPods workspace and resolved Flutter's hybrid SwiftPM/CocoaPods dependency graph.
• Completed signed iOS + Watch archive (blocked locally by missing watchOS 26.2 platform and signing credentials).

Failure-Class: none

[Git-on-my-level]

Verified the version algebra behind this fix, and it checks out:

• firebase_crashlytics 4.3.2 -> 4.3.5 in app/pubspec.yaml is the right pin: on pub.dev, 4.3.5 declares firebase_core: ^3.13.0, which now matches firebase_auth 5.5.3 and firebase_messaging 15.2.5 (both ^3.13.0) against the pinned firebase_core 3.13.0. That removes the flutterfire 3.11.0-vs-3.13.0 SPM conflict from Align Firebase plugin versions so Swift Package Manager can be re-enabled #11676 while leaving the rest of the Firebase set untouched (4.3.5 specifically, since 4.3.6+ already requires core 3.13.1+).
• app/pubspec.lock changes only the crashlytics entry (version + sha256), and the sha256 matches the published pub.dev archive hash for 4.3.5 — no other lockfile drift.
• The enable-swift-package-manager: false block removed from app/pubspec.yaml was the only reference to the opt-out in the repo, so nothing is left stale. The new contract test in app/test/unit/flutterfire_spm_contract_test.dart is a nice touch — it locks the aligned pin set and the opt-out removal so the skew can't silently return. (Minor note: it reads pubspec.yaml via a cwd-relative File(...), which is fine under flutter test from app/, just cwd-dependent.)

One merge gate before this lands: #11676 defines acceptance as an actual iOS archive with the flag removed, and neither this PR (local disk-full, honestly disclosed — thanks) nor CI (the Build/iOS jobs are skipped on this PR) has produced one. SPM resolution happens in Xcode, so a green pub get and Dart CI don't exercise it — and re-enabling SPM moves the whole iOS/macOS native resolution path, not just Firebase. A maintainer-run archive (e.g. the Codemagic dev flavor) should gate the merge; since the description says "Closes #11676", if that archive surfaces any other plugin skew, please reopen the issue rather than letting it close with the remainder untracked.

Tight, well-scoped fix — thanks, and credit for adding the regression contract.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.