fix(app): pin AboutLibraries license JSON so F-Droid reproduces

[vitofico]

Problem

F-Droid's reproducible-build verification failed for v2026.07.10.218. The build itself succeeded — only the copied-signature integrity check failed, and the sole differing file was:

res/M7.json  (AboutLibraries license list, res/raw/aboutlibraries.json renamed by resource shrinking)

Root cause

The AboutLibraries build-time collector scans whatever dependency configurations happen to be resolvable in a given build, so the embedded library set is not reproducible:

Build environment	Library count	Notes
Our published APK	55+	leaked debug/test artifacts (ui-tooling, ui-test-manifest)
F-Droid's isolated builder	31	under-collected — missing even release transitives like androidx.core
Clean local build	175	everything

The existing excludeFields = arrayOf("generated") fixed the build-timestamp but not this membership drift.

Fix

Stop generating the resource at build time and check in a pre-generated, release-only JSON, so every builder (dev, CI, F-Droid) packages byte-identical bytes:

• registerAndroidTasks = false — plugin no longer generates into the APK
• filterVariants = arrayOf("release") — keeps the regenerated file release-scoped
• committed app/src/main/res/raw/aboutlibraries.json (178 libs) → R.raw.aboutlibraries, which LibrariesContainer in LicensesScreen already reads (in-app Licenses screen unchanged)
• CI drift check regenerates and diffs, failing if the committed file goes stale after a dependency change

Regenerate with:

scripts/dgradle :app:exportLibraryDefinitions \
  -PaboutLibraries.exportVariant=release \
  -PaboutLibraries.exportPath=src/main/res/raw

Verification

• Three consecutive exports are byte-identical (sha 3053e3b1) — deterministic
• Release APK's res/M7.json matches the committed source exactly (sha 3053e3b1)
• Committed JSON is release-scoped: no ui-tooling / ui-test-manifest / unit-test libs; timestamp-free
• The PR's own CI drift-check run doubles as the cross-environment determinism test (dgradle vs GitHub runner)

Note

v218 is already published and immutable — F-Droid won't verify it retroactively. This makes the next release reproducible; that's the first tag where the check should pass.