Establish enforceable collector assurance gates

> **Scope narrowed.** The Android field-matrix and real-device evidence regime has been
> removed from this issue. What remains is the work that a build, a test, or a checked-in
> artifact can settle.

## Summary

Establish enforceable assurance gates for collector modules.

A collector is trusted code executing inside the participant app. New collectors must demonstrate bounded behavior, lifecycle correctness, and disclosure accuracy before entering the normal build.

## Requirements

### Static and build-time gates

- Prevent collector modules from introducing:
- network clients or sockets;
- direct file, database, or preference access;
- dynamic loading or downloaded executable content;
- arbitrary logging;
- activity launches or undeclared exported components;
- export, upload, decryption, or cryptographic implementations.
- Enforce each collector's catalog-declared `maximumEncodedEventBytes` before append.
- Snapshot and review the merged manifest, permissions, components, intent filters, foreground-service types, and module dependency graph.
- Fail CI on undeclared permission/component/dependency changes or catalog/implementation mismatch.
- Add architecture tests that keep collectors behind the existing event sink, clock, access, and lifecycle contracts.

### Required collector evidence

Before a collector can ship in the general build, require:

- catalog entry and strict typed schema;
- researcher and participant disclosure in English and Traditional Chinese;
- access-denied and access-revoked behavior;
- start, pause barrier, resume, finish, withdraw, process-recovery, and reboot tests;
- maximum rate/size/quota behavior;
- missing/unsupported hardware behavior;
- threat-model and prohibited-inference review;

## Acceptance criteria

- A collector module that imports a forbidden capability or adds an undeclared component/permission fails CI.
- Oversized encoded events are rejected before append with a deterministic bounded audit result.
- Manifest, permission, service-type, and dependency snapshots are reviewed and reproducible.
- Revocation, pause/withdraw, reboot, quota, outbox-recovery, and lifecycle tests exist for every generally enabled collector.
- A collector without all required disclosure, schema, and lifecycle tests cannot enter the normal release build.
- The assurance system sends no production telemetry and requires no remote control plane.

## Documentation

Add the collector assurance policy, prohibited-dependency rules, release checklist, and test-data policy.

## Dependencies

Blocked by #10, whose catalog supplies collector capabilities, limits, disclosures, schemas, and platform metadata.

Start by reviewing the catalog supplied by blocked issue #10, then trace the existing collector modules and their event sink, clock, access, and lifecycle contracts. Define the static, manifest, dependency, schema, disclosure, quota, recovery, and lifecycle checks described here. Done means forbidden capabilities and undeclared changes fail CI, bounded events are rejected deterministically, required evidence is tested, and the normal release build excludes incomplete collectors.

Written by the indexing model from the issue text.