[FEATURE] Tests: fail when a manifest permission or analytics dependency is added #215

Goal: a Pull Request that adds a manifest permission or an analytics dependency fails the unit tests until a maintainer approves it in a reviewed list.

Evidence: app/src/main/AndroidManifest.xml:11-24 and app/build.gradle.kts:169 · Base commit: 87365a5

The manifest declares a fixed set of permissions today, and the build file has no analytics or crash-reporting dependency:

grep -niE "firebase|crashlytics|sentry|analytics|appcenter" app/build.gradle.kts
# → 0 results

Nothing in the tests watches either. The project already has a unit test that reads source files and compares them with a reviewed list: UiSourceGuardsTest reads files by path with a module-relative fallback and fails on new findings and on stale entries (app/src/test/java/com/tucavr/UiSourceGuardsTest.kt:12,25-26), with its list in app/config/ui-guards/baseline.txt. A new permission or SDK today needs a reviewer to notice it in the diff.

Feasibility: app/src/test/java/com/tucavr/UiSourceGuardsTest.kt:12,25-26 and app/config/ui-guards/baseline.txt are the precedent: reuse the pattern (a test, a reviewed list, failure on both new and stale entries), with a new list under app/config/manifest-guards/.

Effort: 0.5 d

Implementation: add ManifestGuardTest that parses <uses-permission> and <uses-feature> names from the manifest and compares them with app/config/manifest-guards/permissions.txt, and scans app/build.gradle.kts for a short denylist of analytics and crash-reporting artifact names. Seed the permission list from the manifest as it is at the base commit, and fail on stale entries too. Do not change the manifest, the dependencies or CI in this issue.
Acceptance criteria:

• ./gradlew testDebugUnitTest --tests "com.tucavr.ManifestGuardTest" passes on the base commit with the seeded list.
• Adding <uses-permission android:name="android.permission.READ_PHONE_STATE" /> to the manifest makes the same command fail, shown in the Pull Request with a temporary edit that is then reverted.
• Adding implementation("com.google.firebase:firebase-analytics:1.0.0") to app/build.gradle.kts makes the same command fail, shown the same way.
• Removing a permission from the manifest without updating the list makes the same ./gradlew testDebugUnitTest --tests "com.tucavr.ManifestGuardTest" command fail on the stale entry (negative case).

Not verified: the denylist is a short hand-picked set of names and will miss an SDK it does not list, so the test narrows the review but does not replace it. Nothing ran on the headset, and no network behavior was observed; this test says nothing about what the in-app browser's engine sends by default.