docs: answer the Advertising ID declaration from the dependency graph, not from the source

Play asks whether the app uses advertising ID "including any SDKs that your app imports that use
advertising ID", and that clause is the whole difficulty: the ID comes from
play-services-ads-identifier, which merges AD_ID into the manifest by itself - so one unrelated
dependency could turn this answer into a false statement without a line of app code changing. The
answer is No, and the checklist now records how that was established on 2026-10-14 against the
artefacts rather than against intentions:

- the release runtime classpath contains no gms/firebase/ads/billing/play-services entry at all, so
  there is no direct *or transitive* SDK that would ask for the ID
- aapt2 dump badging on the release APK lists the seven permissions the audit table already
  documents plus the framework's DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION - no AD_ID, and no
  Privacy Sandbox permission either
- the same check on base/manifest/AndroidManifest.xml inside the .aab finds nothing, which matters
  because the bundle is the artefact Play's own scanner reads
- the shipped classes.dex contains no com.google.android.gms classes, and the app has no INTERNET
  permission, so an ID could not be transmitted even if one were read

The last two rows are the ones to re-run after any dependency change: they are cheap, and this is
the declaration a stray library answers wrongly on the app's behalf. The same reasoning answers Data
safety's device-identifiers question, which the item now says out loud.

ROADMAP: the remaining-paperwork row names the advertising ID question rather than leaving it
implied by "ads".

docs/PLAY_RELEASE_CHECKLIST.md

@@ -440,6 +440,28 @@ action except the items marked **[code]**.
       account, nothing gated.
 - [ ] **Ads** → *No, my app does not contain ads* (and no ad SDK in
       `gradle/libs.versions.toml` to contradict the answer).
+- [ ] **Advertising ID** → *No, my app does not use advertising ID.* The question adds "This
+      includes any SDKs that your app imports that use advertising ID", so the answer has to come
+      from the dependency graph rather than from the source: `play-services-ads-identifier` is what
+      provides the ID and it merges `AD_ID` into the manifest on its own, so adding any ad or
+      analytics SDK would flip this answer to *Yes* without one line of app code changing. Audited
+      2026-10-14 against the shipped artefacts rather than against intentions:
+
+      | Check | Command | Result |
+      |---|---|---|
+      | no advertising/analytics SDK, direct **or transitive** | `./gradlew --offline -q :app:dependencies --configuration releaseRuntimeClasspath \| grep -iE 'gms\|firebase\|ads\|billing\|play-services'` | no output |
+      | no `AD_ID` and no Privacy Sandbox permission in the release APK | `aapt2 dump badging app/build/outputs/apk/release/app-release.apk \| grep -i permission` | exactly the audit table above — 7 requested, plus the framework's `…DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION` |
+      | the same for the **`.aab`**, which is the artefact Play scans | `unzip -p app/build/outputs/bundle/release/app-release.aab base/manifest/AndroidManifest.xml \| strings \| grep -x 'AD_ID'` | 0 hits |
+      | no Play Services classes in the shipped code | `unzip -p app/build/outputs/apk/release/app-release.apk classes.dex \| grep -a -c 'com/google/android/gms'` | 0 |
+      | nothing could be sent even if an ID were read | the permission audit above | no `INTERNET` |
+
+      This is the machine-checked version of what [PRIVACY.md](../PRIVACY.md) promises in words
+      ("does not collect … advertising identifiers", "does not contain advertising SDKs or
+      third-party trackers"), so re-run the first two rows after **any** dependency change —
+      including one that looks unrelated. This is the declaration a stray library can answer
+      wrongly on the app's behalf, and the *Data safety* form's *Device or other IDs* answer is
+      *No* for the same reason.
+
 - [ ] Select the target audience (not designed for children).
 - [ ] Answer the remaining *App content* declarations **No** / not applicable: news app,
       government app, financial features, health, COVID-19 contact tracing.