android: run ktlint and detekt from the image, not as Gradle plugins

First Android run failed at plugin resolution:

  Plugin [id: 'io.gitlab.arturbosch.detekt', version: '2.0.0-alpha.3'] was not
  found in any of the following sources

That version is published to neither Maven Central nor the plugin portal — the
latest detekt anywhere is 1.23.8. It was copied from Minstrel's catalog, where it
presumably resolves from a cached artifact; copying a pin without checking it
exists is what made it my problem.

Rather than chase a working plugin version, the analyzers now run from the CLIs
ci-rust-android already ships. That was the point of putting them in the image in
step 3, and going through Gradle plugins would have meant a SECOND pinned version
of each tool, resolved at build time, kept in lockstep with the image's by hand.
One less resolution step, and step 3's decision finally earns its keep.

Also replaces the source-ordering hack while here. Kotlin has to compile after
the bindings are generated, and the usual `tasks.withType<KotlinCompile>` cannot
be written in this build at all — AGP 9's built-in Kotlin means that class is not
on the buildscript classpath. Passing the TASK PROVIDERS to srcDir instead lets
Gradle read their @OutputDirectory and infer the ordering itself, which is the
idiomatic form and removes the dependsOn entirely.

Good news from the failed run: the Gradle wrapper check passed, so Gradle 9.1.0
on the image's JDK 25 works — the toolchain decision from step 3 holds.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.forgejo/workflows/android.yml

@@ -79,11 +79,18 @@ jobs:
       - name: Build the native library and bindings
         run: ./gradlew generateUniffiBindings
 
+      # The image's PINNED CLIs, not Gradle plugins. ci-rust-android carries both
+      # (M12 step 3) precisely so this lane needs no second image, and going
+      # through Gradle plugins would mean a second version of each tool resolved
+      # at build time and kept in lockstep with the image's by hand.
+      #
+      # Scoped to src/main: the generated uniffi bindings live under build/ and
+      # are not ours to style.
       - name: ktlint
-        run: ./gradlew ktlintCheck
+        run: ktlint "app/src/main/**/*.kt"
 
       - name: detekt
-        run: ./gradlew detekt
+        run: detekt --build-upon-default-config --config config/detekt.yml --input app/src/main/java
 
       - name: Unit tests
         # Host-JVM tests only. Anything touching the core needs an Android