[A-EDev]

Summary

Subscription groups merged channelIds as a plain union, so sync could add a channel to a group but never remove one: the other device's copy put it back. Flow-Tube/flow-sync#38 adds per-member stamps, and this implements them:

• CanonicalSubscriptionGroup carries members (channelId, hlc, deleted) next to channelIds, which stays the live list for older apps. It's left out when a group has none, so such records stay byte-identical to before; a test pins the exact wire shape Flow Desktop emits (fix(sync): let sync remove a channel from a group Flow-Desktop#318).
• SubscriptionsMerger merges members like playlist items: per channel, the newest stamp wins, and a removal is a tombstone. A record without members (from an older app) counts each of its channelIds as present at the record's stamp.
• SyncChangeTracker tracks members in their own ledger (subscription_members), the same way it tracks playlist items, so removing a channel here goes out as a member tombstone. Its tombstone helper is now shared by playlist items and group members.

Related issue

Part of #1075 (linked devices).

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

• ./gradlew :app:assembleGithubDebug: ok
• ./gradlew :app:testGithubDebugUnitTest: 4570 passed, 46 skipped, 0 failed; new MergeConvergenceTest.a_channel_removed_from_a_group_stays_removed (merge laws with an older app's record, and the byte-exact wire shape); after the follow-up commit, the sync tests (162 passed), ktlintCheck and assembleGithubDebug were rerun and pass and SyncChangeTrackerTest.a_channel_removed_from_a_group_goes_out_as_a_member_tombstone
• ./gradlew ktlintCheck: ok
• python3 .github/scripts/nightly_notes.py --check: 31 nightly notes are valid
• I manually tested the affected behavior on an Android device or emulator. (Not run on a device; covered by unit tests.)

Test device and Android version: none (JVM tests)

Risk and compatibility

A backward-compatible record addition. Older Android and Desktop versions ignore members and keep the union behavior. One new ledger file, which reset() clears with the others. Flow Desktop ships the same rule in its own PR.

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources. (None.)
• Dependency and lockfile changes are intentional and limited to this PR. (None.)
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented. (None.)