App embeds the CA of the machine that builds it

PinnedCert.kt no longer carries a pasted certificate. The build reads
$XDG_CONFIG_HOME/ai-app/certs/ca.pem (AI_APP_CA overrides) and generates
the constant, so the trust anchor follows the build machine: an APK built
on the backend host pins that host, and one built in the dev VM pins the
VM's throwaway CA and is good only for its emulator.

That removes the reason to add a second trust anchor for development --
there is nothing to add and then forget to remove -- and it means the
private key never has to exist near this repo, which the VM can write.
Regenerating a CA now needs a rebuild instead of a paste, so a stale
constant can't quietly disagree with the server.

build-apk.sh is the missing counterpart to run-android.sh: it produces
the APK to install through Local Updater and touches no emulator. It
finds the SDK from ANDROID_HOME/ANDROID_SDK_ROOT before falling back to
~/Android/Sdk, since the host doesn't share the VM's layout, and prints
the fingerprint of the CA being pinned so a wrong one is visible there
rather than as a handshake failure on the phone.

Verified end to end on the emulator against a server using a freshly
generated CA -- which is how the first attempt was caught: the generated
constant began with a newline, so CertificateFactory lost the "-----BEGIN"
sniff, tried DER, and failed at runtime with an ASN.1 decode error.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

AGENTS.md

@@ -59,8 +59,15 @@ real-phone/WireGuard bring-up, which is operational rather than code.
 
 - Server: `./run-tests.sh` (or `cargo test`) + `cargo clippy --all-targets`
   from `server/` — the build stays warning-clean, keep it that way.
-- App: from `app/`, `. ./android-env.sh && ./gradlew :androidApp:compileDebugKotlin`;
-  `./run-android.sh` builds, installs, and launches on the emulator.
+- App: from `app/`, `. ./android-env.sh && ./gradlew :androidApp:compileDebugKotlin`
+  to typecheck; `./build-apk.sh` to produce the APK to install on a phone
+  (through Local Updater); `./run-android.sh` to build, install, and launch
+  on the emulator.
+- **The APK pins the CA of the machine that builds it**, read at build time
+  from `$XDG_CONFIG_HOME/ai-app/certs/ca.pem` (`AI_APP_CA` overrides) and
+  generated into a constant. So `./gen-dev-cert.sh` must have run on that
+  machine first — the build stops with that instruction otherwise — and an
+  APK built in this VM only works against a server in this VM.
 - Run the server for development with `--bind 127.0.0.1` (wg0 doesn't exist
   on this machine yet; the default fails closed). First run prints the
   enrollment QR/URI with the token — capture it from the log.
@@ -138,6 +145,14 @@ Established 2026-08-25, and it decides more than it looks like:
 - **CMP 1.11 deprecates the `compose.*` dependency accessors** — declare
   `org.jetbrains.compose.<x>:<x>` directly (material3 has its own release
   train, separate from the CMP version).
+- **A PEM constant must start at the opening quotes.** A generated
+  `"""\n-----BEGIN CERTIFICATE-----` costs Android's `CertificateFactory`
+  its preamble sniff, so it tries DER instead and fails at runtime with
+  `ASN.1 ... DECODE_ERROR` — nowhere near the code that produced it.
+- **AGP 9 refuses `Provider`s in the source-set API**: generated sources go
+  through `androidComponents.onVariants { it.sources.java?.addGenerated
+  SourceDirectory(task, Task::outputDir) }`, which also carries the task
+  dependency.
 
 ## Environment notes (this machine, learned in local-updater)