feat(android): cross-activity show, lifecycle, and webview retention

[jboileau99]

Description of this change

Track foreground Activity for show-from-any-activity, auto-dismiss on real navigation, and retain the WebView on hideExperience for faster re-shows and post-hide JS events.

• KetchLifecycleTracker.kt / KetchSdk.kt: foreground Activity tracking; SDK create without FragmentManager.
• Ketch.kt: lazy host resolution, auto-dismiss, loadedSignature warm/cold paths, retain-on-hide vs kill on other teardown, preference-tab JSON for imperative show.
• KetchWebView.kt / KetchDialogFragment.kt / Index.kt: detach/kill ownership, showConsentExperience/showPreferenceExperience, remove tap-outside bridge.
• integration-tests/: cross-activity, auto-dismiss, benign lifecycle, WebView retention, preference-tab DOM tests; reflection probes in IntegrationTestApp.kt.
• sample-app-* / Makefile / scripts/run-sample.sh: cross-activity demo, shared-preferences debug, local run targets.

Why is this change being made?

• Chore (non-functional changes)
• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How was this tested? How can the reviewer verify your testing?

• ./gradlew ktlintCheck — pass
• ./gradlew :integration-tests:connectedDebugAndroidTest — pass on Pixel 9a (API 16) emulator, including ZCrossActivityShowTest, ZWebViewRetentionTest, and ZPreferenceTabArgsTest

Related issues

N/A

Checklist

• I have added tests to cover my changes.
• All new and existing tests passed.
• I have evaluated the security impact of this change, and OWASP Secure Coding Practices have been observed.
• I have informed stakeholders of my changes.

---

Note

High Risk
Large behavioral changes to Activity/WebView/dialog lifecycle and public init patterns affect every integrator; mistaken auto-dismiss or WebView retention could strand UI or leak context, though new instrumented coverage targets the main paths.

Overview
The SDK no longer requires a FragmentManager at create time: KetchLifecycleTracker tracks the foreground FragmentActivity, and KetchSdk.create(context, …) is the primary factory (the FragmentManager overload is deprecated). Experiences can be shown from any activity; navigating to another activity while a dialog is open auto-dismisses with onDismiss(HideExperienceStatus.ActivityChanged), while rotation and backgrounding keep the experience alive.

WebView lifecycle is reworked around a loadedSignature cache: matching config reuses a warm WebView via imperative ketch('showConsent') / showPreferences JS instead of reloading. hideExperience retains the WebView for fast re-show and trailing bridge events; other dismiss paths (dismissDialog, renderer gone, config invalidation) tear it down. Tap-outside dismissal and the tapOutside JS bridge are removed.

Supporting changes include setWebResourceUrlOverrides (HTML + WebResourceOverrideHandler), IntegrationTestApp-based harness with Z* instrumented tests (cross-activity, auto-dismiss, benign lifecycle, retention, preference tabs), sample apps on Application-scoped Ketch, Makefile / run-sample tooling, Cursor rules/skills, and README integration docs.

^{Reviewed by Cursor Bugbot for commit 8c8d6ec. Configure here.}