vc=88: deferred-hygiene sweep (audit #2 leftovers, no behavior change)

M-2: route every SharedPreferences write (Settings/History/Subs/Resume) through
one PrefsWriter — a per-store single-thread dispatcher — so the on-disk apply()
order matches the in-memory CAS order. Previously a Main-thread toggle and an
IO-thread import could land apply() out of order, and ResumePositions detached
ordering entirely via a fresh globalScope.launch per write; a stale value could
then win the next cold-start load. Each write reads the live StateFlow so disk
converges to the latest in-memory state regardless of enqueue order.

L-14: Settings storage-usage sampling (File.length() x4 + Coil diskCache.size)
moved off the composition/Main thread into a LaunchedEffect on Dispatchers.IO.

L-2 / L-4..L-8 / L-15 / L-16: dead code + stale comments from the vc=85 SB/RYD
to Rust migration. Http.kt trimmed to STRAW_USER_AGENT; reconciled the
network_security_config / feed.rs / SubscriptionFeedViewModel / net.rs / CI
comments with reality; recencyScore overflow-guarded; ci/Dockerfile now
pre-installs build-tools 36 (AGP 9.2.1's actual floor, was auto-fetched).

Verified: headless compileDebugKotlin green on the straw-build image.

rust/strawcore/src/net.rs

@@ -57,6 +57,11 @@ fn client() -> Option<&'static Client> {
 /// exceeds `cap`. Shared with the RSS feed path (`feed.rs`). Per-chunk
 /// guard first (HTTP allows multi-GiB chunks; hyper may have already
 /// allocated one before we see it), then the running total.
+///
+/// The cap bounds gzip-DECOMPRESSED bytes (reqwest is built with `gzip`),
+/// not wire bytes — same as the old OkHttp `cappedString`, and fine for the
+/// few-hundred-byte-to-low-KB RYD / SponsorBlock / RSS payloads. A hostile
+/// host could force up-to-`cap` decompression, but never enough to OOM.
 pub(crate) async fn read_capped_body(resp: reqwest::Response, cap: usize) -> Option<String> {
     use futures::StreamExt;
     let mut total = 0usize;