fix(deps): stop Renovate bumping androidx past the compileSdk 36 pin

[willgriffin]

{"schema":"hv-agent-run:v1","runtime":"claude","session":"8a94e288-0358-403f-a3a6-8e81a80e6c5d","issue":"2234","head_sha":"9689dd41c0716d4606ffa9dc55940078b87780bb","policy_revision":"1.0.0","status":"complete"}

Summary

smrt-android library + sample fails on every weekly dependency PR because Renovate bumps
two Gradle versions past a constraint that libs.versions.toml records only in a comment:

 # 1.18+ requires compileSdk 37; the toolchain pin is compileSdk 36.
-core-ktx = "1.17.0"
+core-ktx = "1.19.0"
 # 2.11+ requires compileSdk 37; the toolchain pin is compileSdk 36.
-lifecycle = "2.10.0"
+lifecycle = "2.11.0"

:sample:checkDebugAarMetadata then fails with Dependency 'androidx.core:core-ktx:1.19.0' requires ... version 37 or later of the Android APIs. :sample is currently compiled against android-36. Renovate cannot read the comments, so this recurs weekly — it is currently red
on #2189.

Change

Two allowedVersions rules in renovate.json, matched to exactly the two modules the
catalog declares (androidx.core:core-ktx, androidx.lifecycle:lifecycle-runtime-compose).
This mirrors how that file already encodes the starter-template pin: a description giving
the reason, so the rule can be removed deliberately rather than guessed at later.

Why not raise compileSdk to 37

compileSdk 36 is an existing, recorded decision — packages/smrt-android/AGENTS.md states
the toolchain as "Gradle 9.6.1 / compileSdk 36 / minSdk 26 / JVM 21", and both catalogs pin
android-compile-sdk = "36". Moving to 37 is the mobile owner's call and would need the CI
Android SDK platform to move with it. This PR only makes Renovate honour the decision that
is already made; the rules are removed in whichever change does raise the toolchain.

Validation

• renovate-config-validator — Config validated successfully against 1 file(s)
• node -e "JSON.parse(...)" — valid JSON
• biome check renovate.json — path is ignored by the repo's Biome config, so no diagnostics apply
• Config-only change; no package or source code is touched, so no test suite is in scope

Closes #2234

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Pull request overview

Updates Renovate configuration to prevent weekly dependency PRs from bumping specific AndroidX dependencies past versions that require compileSdk 37, while the repo’s Android toolchain is intentionally pinned to compileSdk 36 (per packages/smrt-android/AGENTS.md and both Android version catalogs).

Changes:

• Add Renovate packageRules to cap androidx.core:core-ktx to <1.18.
• Add Renovate packageRules to cap androidx.lifecycle:lifecycle-runtime-compose to <2.11.
• Document the rationale inline in renovate.json so the constraint is explicit and removable when the toolchain is bumped.

[willgriffin]

Superseded by #2245, which carries this commit cherry-picked verbatim alongside the other three patch-class changes.

Consolidated to spend one validation pass instead of four. For #2205 and #2233 specifically it also resolves a real collision — both rewrite pnpm-workspace.yaml and pnpm-lock.yaml, so merged separately they conflict and the second would need a rebase and lockfile regeneration regardless. #2245 regenerates the lockfile once over both edits (zero drift, supply-chain check clean).

Branch preserved.