vc=88: deferred-hygiene sweep (audit #2 leftovers, no behavior change)

M-2: route every SharedPreferences write (Settings/History/Subs/Resume) through
one PrefsWriter — a per-store single-thread dispatcher — so the on-disk apply()
order matches the in-memory CAS order. Previously a Main-thread toggle and an
IO-thread import could land apply() out of order, and ResumePositions detached
ordering entirely via a fresh globalScope.launch per write; a stale value could
then win the next cold-start load. Each write reads the live StateFlow so disk
converges to the latest in-memory state regardless of enqueue order.

L-14: Settings storage-usage sampling (File.length() x4 + Coil diskCache.size)
moved off the composition/Main thread into a LaunchedEffect on Dispatchers.IO.

L-2 / L-4..L-8 / L-15 / L-16: dead code + stale comments from the vc=85 SB/RYD
to Rust migration. Http.kt trimmed to STRAW_USER_AGENT; reconciled the
network_security_config / feed.rs / SubscriptionFeedViewModel / net.rs / CI
comments with reality; recencyScore overflow-guarded; ci/Dockerfile now
pre-installs build-tools 36 (AGP 9.2.1's actual floor, was auto-fetched).

Verified: headless compileDebugKotlin green on the straw-build image.

.forgejo/workflows/build.yml

@@ -85,7 +85,10 @@ jobs:
           echo "Built vc=$VC -> $NAME"
           # The whole series is signed with SHA-1 bb9ca96b...; fail loudly if a
           # build ever produces a different signer (would break in-place updates).
-          # Pick whatever build-tools the image actually ships (36 today, not 34).
+          # apksigner lives under build-tools/<ver>/. AGP (compileSdk 36) needs
+          # build-tools 36; older straw-build images pre-installed only 34.0.0 and
+          # AGP auto-fetched 36 at build time, so this sort -V | tail -1 resolves to
+          # 36.0.0's apksigner. (ci/Dockerfile now pre-installs 36 too — see there.)
           # apksigner is a shell wrapper that needs `java` on PATH; the image
           # sets JAVA_HOME but doesn't put its bin on PATH for run steps (gradle
           # uses JAVA_HOME directly, so the build itself is fine).