Make the gate one command, and add static analysis behind a baseline

Everything this repository promised was voluntary until now: 371 tests, lint and the generated code
map ran only if whoever changed the code remembered to run them. tools/verify.sh is that gate as one
command - the map check, detekt, the unit tests and lint, cheapest first so a stale document fails in
a second rather than after a release build - and --release adds the R8 build. The ordering is not
cosmetic: the two cheapest checks are also the two that catch drift nothing else can see.

The same script runs in three places: CI on every push and pull request, a nightly --release job (R8
is the one check nothing else performs, and it has hidden a real defect here once), and a pre-push
hook once the clone has been told to use .githooks. The nightly also uploads the R8 mapping, which is
what turns a release stack trace back into a line of Kotlin and is only worth keeping if it belongs
to the build that shipped.

Detekt is adopted with a baseline, which is the entire adoption strategy: everything it finds today
is frozen in config/detekt/baseline.xml, so the gate fails on a new finding rather than on a backlog
nobody is going to clear this week. Entries are keyed by rule, file and enclosing declaration, so a
new long function is still reported inside a file that already has one - proved by writing a TODO
into a file, watching the build fail on that exact line, and taking it out again. What it found
first agrees with the churn numbers from the last pass: ArchiveEngine 16 findings, BrowserViewModel
11, SelectionBar 9, 86 in total over 13 rules, the largest groups being the complexity ones this was
added for (cyclomatic complexity 10, nested block depth 7, too many functions 4, long methods 3, two
classes over 700 lines) plus 30 over-long lines.

Three findings were fixed rather than parked, because they were real: dead `menuOpen` state left in
BrowserScreen when the overflow menu moved into BrowserTopBar, a missing trailing newline, and two
`db` parameters that are the platform's signature rather than an oversight (suppressed with that
reason written next to them). Four rules were configured rather than obeyed: PackageNaming, because
the applicationId's underscore is an identity this app cannot change; FunctionNaming, for @Composable
(PascalCase by convention) and for backticked test names, which is the project's specification style;
MagicNumber, because sizes and limits are named constants here; and MatchingDeclarationName, because
a file is named after its concept rather than after a declaration inside it.

Two tooling facts cost real time and are in neither tool's documentation. Detekt runs through its CLI
rather than its Gradle plugin: the plugin performs the analysis inside the build's own JVM, and
detekt 1.23 cannot parse JDK 25's version string - it fails with "25.0.4.1" as the entire error
message - so the task drives detekt-cli on a 21 launcher, which is also the only way to pin the JVM
the analyser runs on. And a baseline has to exist before it can be read, which is why it starts as an
empty document rather than being generated into place.

Verified: the fast gate is green in 17 seconds, --release adds a 36-second R8 build, 371 JVM tests
still pass, lint is clean and the map is current. CHANGELOG, README, AGENTS.md, ROADMAP (the gate is
now a recorded decision) and the regenerated map carry it.

CHANGELOG.md

@@ -125,6 +125,39 @@ upload needs a **higher `versionCode`** than every previous upload.
   home screen lists it above the libraries; the row opens it with the star already filled; and
   removing it from the row takes the whole section away with a snackbar.
 
+- **One command is now the gate, and Kotlin static analysis is part of it.** `tools/verify.sh` runs the
+  code-map check, detekt, the unit tests and lint — cheapest first, so a stale document fails in a
+  second rather than after a release build — with `--release` adding the R8 build. The same script
+  runs in `.github/workflows/verify.yml` on every push and pull request, nightly with `--release`, and
+  in a pre-push hook once `git config core.hooksPath .githooks` has been run. Until now every
+  guarantee was voluntary: 371 tests, lint and the map ran only if someone remembered, which was the
+  largest maintenance risk this repository had.
+
+  **Detekt is adopted with a baseline, and that is the whole point**: everything it finds today is
+  frozen in `config/detekt/baseline.xml`, so the gate fails on a *new* finding rather than on a
+  backlog nobody is going to clear this week. Entries are keyed by rule, file and enclosing
+  declaration, so a new long function is still reported inside a file that already has one — proved
+  by writing a `TODO` into a file, watching the build fail on that line, and removing it. What it
+  found first is what the churn numbers had already said: `ArchiveEngine` 16 findings,
+  `BrowserViewModel` 11, `SelectionBar` 9 — 86 over 13 rules, the largest groups being the complexity
+  ones this was added for (cyclomatic complexity 10, nested depth 7, too many functions 4, long
+  methods 3, two classes over 700 lines) and 30 over-long lines. Three findings were fixed rather
+  than parked: dead `menuOpen` state in `BrowserScreen`, a missing trailing newline, and two `db`
+  parameters that are the platform's signature rather than an oversight (suppressed, with the
+  reason). Four rules were configured rather than obeyed: `PackageNaming`, because the
+  applicationId's underscore is an identity this app cannot change; `FunctionNaming` for `@Composable`
+  (PascalCase by convention) and for backticked test names; `MagicNumber`, because sizes and limits
+  are named constants here; and `MatchingDeclarationName`, because a file is named after its concept.
+
+  Two tooling facts are recorded because they cost time and are in neither tool's documentation.
+  Detekt runs through its **CLI** rather than its Gradle plugin: the plugin performs the analysis
+  inside the build's own JVM, and detekt 1.23 cannot parse JDK 25's version string — it fails with
+  `25.0.4.1` as the entire error message — so `:app:detekt` drives `detekt-cli` on a 21 launcher,
+  which is also the only way to pin the JVM the analyser runs on. And a baseline has to *exist*
+  before it can be read, which is why it starts as an empty document instead of being generated into
+  place. **371 JVM tests** still pass, lint is clean, the map is current, and the gate is green in
+  17 seconds.
+
 ### Changed
 
 - **File thumbnails are bigger.** The leading visual in a list row went from 28 dp to 48 dp and