Update the Tauri stack to tauri 2.12 / tao 0.37 / wry 0.57 and drop the Android ndk-context workaround #820

Goal

The core builds and tests the Tauri family and the platform-near crates at the current release line (tauri 2.12, tao 0.37, wry 0.57), so that an app crate embedding app-shell ships exactly the stack the core's CI (three desktop OSes, real-app start, Android build and emulator launch test) has tested. The Android ndk-context workaround, which turns into a launch crash on tao ≥ 0.37, is removed and can no longer silently come back.

Context

• Cargo.lock resolves tauri 2.11.5, tauri-runtime 2.11.3, tauri-runtime-wry 2.11.4, tauri-build 2.6.3, tauri-utils 2.9.3, tauri-codegen/tauri-macros 2.6.3, tao 0.35.3, wry 0.55.1, webview2-com/-sys 0.38.2, muda 0.19.3, tray-icon 0.24.2, window-vibrancy 0.6.0, tauri-plugin-dialog 2.7.2, tauri-plugin-fs 2.5.1, tauri-plugin-single-instance 2.4.5, keyring 4.1.6, secret-service 5.1.0, russh 0.63.1. The manifests only ask for tauri = "2" etc. (crates/app-shell/Cargo.toml:32-60, apps/smart-ssh-community/Cargo.toml:23-50), so an embedding app crate with its own lockfile resolves a newer stack than the one the core tests.
• Frontend: apps/smart-ssh-community/frontend/package.json:23 "@tauri-apps/api": "^2.11.1", :41 "@tauri-apps/cli": "^2.11.4".
• Android workaround (issue Android: app aborts at launch (Keystore store without Android context, file plugin's Android part not bundled) #795): apps/smart-ssh-community/gen/android/app/src/main/java/io/crates/keyring/Keyring.kt binds the JNI function initializeNdkContext of android-native-keyring-store, and MainActivity.kt:19-22 calls Keyring.initializeNdkContext(applicationContext) before super.onCreate, because tao 0.35 does not create the Android context. tao 0.37 does it itself: tao-0.37.1/src/platform_impl/android/ndk_glue.rs:411 calls ndk_context::initialize_android_context in onCreate (inside super.onCreate). With tao ≥ 0.37 the workaround initializes the context twice and the Rust side panics at launch. Following the current docs with a tao 0.37 lockfile leads to exactly this launch crash.
• docs/android-build.md:41 ("Tauri/tao legen ihn nicht an … Eine andere App-Crate kopiert beides") and the comment in MainActivity.kt:19-21 ("copy it into the MainActivity of any app crate that embeds app-shell") tell embedders to copy the workaround. docs/adr/0148-mobile-build-struktur.md still lists under "Offen" that gen/android is not checked in (it is, 44 files).
• Nothing couples the workaround to the tao version: the next lockfile refresh would break the Android launch without a failing unit test (only the emulator job would catch it).
• CI: .github/workflows/community.yml jobs android-build (:444) and android-launch-smoke (:554, scripts/android-launch-smoke.sh) build and start the debug APK on every PR; community.yml:511-512 installs tauri-cli --version '^2'.

Requirements

• Update Cargo.lock with cargo update -p <crate> --precise <version> (no manifest-wide cargo update) to these exact versions, which are known to build and launch on Android together:

  crate	target
  tauri / tauri-runtime / tauri-runtime-wry	2.12.1 / 2.12.1 / 2.12.1
  tauri-build / tauri-utils / tauri-codegen / tauri-macros	2.7.1 / 2.10.1 / 2.7.1 / 2.7.1
  tao / wry	0.37.1 / 0.57.0
  webview2-com / webview2-com-sys	0.39.1 / 0.39.1
  muda / tray-icon / window-vibrancy	0.20.0 / 0.25.1 / 0.8.1
  tauri-plugin-dialog / tauri-plugin-fs / tauri-plugin-single-instance	2.7.3 / 2.5.2 / 2.5.2
  keyring / secret-service	4.2.0 / 5.2.0
  russh	0.63.2

  Crates that follow transitively (e.g. urlpattern) take whatever these versions require. If one of the listed versions cannot be selected (yanked, conflicting requirement), take the nearest compatible version and list the deviation in the PR description.

• Raise the version requirements in the manifests where the code relies on the new line (at least tauri-plugin-dialog = "2.7.3", tauri-plugin-single-instance = "2.5.2" in crates/app-shell/Cargo.toml and apps/smart-ssh-community/Cargo.toml), so an embedding app cannot resolve an older line than the one tested.

• Frontend: @tauri-apps/api and @tauri-apps/cli on the same minor as the tauri crate (^2.12.x), package-lock.json regenerated with npm install, not edited by hand. Other @tauri-apps/plugin-* packages to the version matching their crate where a matching release exists.

• Remove the workaround: delete gen/android/app/src/main/java/io/crates/keyring/Keyring.kt, remove the import and the Keyring.initializeNdkContext(...) call plus its comment from MainActivity.kt. The keychain probe and voice input keep working because tao now provides the context.

• New Rust test in apps/smart-ssh-community/tests/ (e.g. android_ndk_context.rs): reads the tao version from the workspace Cargo.lock; for tao ≥ 0.37 it asserts that no Kotlin file under gen/android/app/src/main/java/ calls initializeNdkContext (comments ignored) and that io/crates/keyring/Keyring.kt does not exist; for tao < 0.37 it fails with a message that the context must then be initialized by the app again (see docs/android-build.md). Include a counter-proof (the check function rejects a fixture that calls initializeNdkContext).

• docs/android-build.md, section "App-Crates, die app-shell einbetten": rewrite point 1: since tao 0.37 tao initializes the ndk-context in onCreate; an app crate must not initialize it again (double initialization panics at launch); name the tao version the statement depends on and the guard test. Keep points 2 and 3. Add a short checklist of what an embedding app crate needs from gen/android today (the Kotlin plugin classes SessionServicePlugin, SessionService, MicrophonePlugin under com/smartssh/desktop/, the manifest permissions and the <service> entry, the strings they use, the direct tauri-plugin-fs dependency, the MainActivity insets code).

• MainActivity.kt: keep the insets code (Android: keep the UI clear of the status bar, navigation bar and keyboard (system bar insets) #802); the remaining comments must not tell embedders to copy the ndk-context call.

• ADR 0148: replace the stale "gen/android ist noch nicht eingecheckt" item with the current state (checked in; ndk-context comes from tao ≥ 0.37, guarded by the new test).

• Fix any compile errors, deprecations or clippy findings the new versions bring, without changing behaviour. If a Tauri API change forces a behaviour change, describe it in the PR.

Acceptance Criteria

• Cargo.lock contains exactly one version of each crate in the table above, at the listed version (or a deviation documented in the PR)
• Keyring.kt no longer exists; no Kotlin file under apps/smart-ssh-community/gen/android calls initializeNdkContext
• The new tao/ndk-context test passes; temporarily adding an initializeNdkContext call to MainActivity.kt makes it fail (shown in the PR description), and its counter-proof fixture test passes
• CI jobs "Android debug APK" (incl. the 16 KB alignment check) and "Android launch smoke test" are green on the PR
• npx tauri info in apps/smart-ssh-community/frontend reports tauri crate and @tauri-apps/api / @tauri-apps/cli on the same minor (2.12) without a version mismatch warning (output in the PR description)
• docs/android-build.md and ADR 0148 describe the tao-version dependency; no text tells an embedding app crate to initialize the ndk-context itself
• Test matrix (Linux, Windows, macOS), browser tests and real-app tests are green
• Relevant automated tests pass

Technical Notes

• Affected: Cargo.lock, crates/app-shell/Cargo.toml, apps/smart-ssh-community/Cargo.toml, apps/smart-ssh-community/frontend/package.json + package-lock.json, apps/smart-ssh-community/gen/android/app/src/main/java/{com/smartssh/desktop/MainActivity.kt,io/crates/keyring/Keyring.kt}, new test under apps/smart-ssh-community/tests/, docs/android-build.md, docs/adr/0148-mobile-build-struktur.md.
• credentials-keyring keeps its android-native-keyring-store dependency; only the Kotlin binding of its context initializer goes away. The keychain availability probe (probe_keychain_availability) runs after onCreate; check in the emulator logcat of the smoke job that the probe does not report a missing context.
• keyring/secret-service touch the credential store (security-relevant area, see .claude/skills/smart-ssh-coder/references/security-invariants.md): no behaviour change intended; the existing credential tests must stay green unchanged.
• Tauri 2.12 may regenerate gen/schemas/* and capability schemas; commit the regenerated files.
• No CI workflow change is required. If community.yml needs one (e.g. a tauri-cli pin), it is a .github/ change and needs maintainer approval before merge.

Spec impact: none (ADR 0148 and docs/android-build.md are updated)

Open questions

• If tauri 2.12.1 pulls a wry/webkit2gtk combination that the Linux real-app tests reject: options (a) take the newest 2.12.x patch release that passes, (b) stay on 2.11 and report. Recommendation: (a), documented in the PR.

Related Work

• Android: app aborts at launch (Keystore store without Android context, file plugin's Android part not bundled) #795 (ndk-context workaround), Android: align the native library for 16 KB memory pages #796 (16 KB alignment), CI: start the Android debug APK in an emulator and fail on a crash at launch #797 (emulator launch test), Android: keep the UI clear of the status bar, navigation bar and keyboard (system bar insets) #802 (insets)