Release 1.1.21: public core packages, transactional file operations, Cloud vault retirement (app core 2.51.0)

[adibhanna]

Summary

Replace the cloned desktop source and private renderer/store imports with the published @zennotes/app-core, @zennotes/bridge-contract, and @zennotes/shared-domain packages. Android keeps ownership of native storage, Cloud transport, gestures, and keyboard behavior while driving editor and workspace actions through public core APIs.

• Vendor the published desktop release core-2.51.0-core.h49d73b531d346192 (desktop commit 8ff2cb86, tag v2.51.0, clean tree); vendor/zennotes/manifest.json records version, sha256, integrity, and source commit, and the archives are byte-identical to the release assets. npm run boundaries:check verifies checksums, installed versions, singleton React/CodeMirror/Lezer, and that no import reaches a private core path.
• Coordinate native vault rename/move with save draining, workspace identity, reopen, and rollback through core's workspace transition; reject stale attachment and gesture contexts after a transition.
• Move note/folder/trash file operations onto relocateVaultEntries (content and comment sidecars move together, rollback on failure; folder rename restores settings; Empty Trash detaches before deleting).
• Preserve SAF error distinctions for missing files, directories, revoked access, and provider failures, with an instrumentation fixture against a real content provider; SAF rename-after-move rolls back on failure.
• Retire a Cloud vault the server reports as deleted (desktop #791): unlink only that association, archive its sync state (including unsent conflict drafts), keep local notes and other links.
• Report platform: 'android' and hostKind: 'android'; carry the desktop audit overrides; adopt the dependabot bumps merged in build(deps-dev): bump the development-dependencies group across 1 directory with 6 updates #67/build(deps): bump the production-dependencies group across 1 directory with 6 updates #68.
• Bump to 1.1.21 (versionCode 23). Supersedes Refactor(android): consume the shared editor through public packages #66.

Validation

• npm run boundaries:check, npm test (149), npm run typecheck, npm run build; boot-path static closure 1.58 MB with no diagram/graph libraries.
• Gradle unit tests (9), lint (0 errors), debug build; androidTest compiles.
• Android 15 emulator (Pixel 7 AVD), fresh install: onboarding, vault creation, edit mode, keyboard toolbar (bold, task list) with autosave on disk, More sheet, Delete with confirmation, Browse drawer; bridge lifecycle over devtools (rename with comment sidecar byte-exact, trash, restore, Empty Trash, re-trash, permanent delete, no leftover temp dirs); cold relaunch and reinstall over existing data.
• Not covered here: physical devices, live Cloud-vault deletion (adapter tests only), SAF providers other than the test fixture.