Analytics: SecurityException "GoogleCertificatesRslt: not allowed" in play-services-measurement-base 23.2.0 (BoM 34.11.0+) on stock Android 14–16 devices

### [READ] Step 1: Are you in the right place?

Yes, this is a runtime crash whose stack trace originates entirely inside `play-services-measurement-base` (this repo). No frames from our application code appear in the trace, so we cannot work around it from app code.

### [REQUIRED] Step 2: Describe your environment

- Android Studio version: **Android Studio Otter 3 Feature Drop | 2025.2.3**
- Firebase Component: **Analytics (play-services-measurement-base)**
- Component version: **23.2.0 (Firebase BoM 34.11.0; also reproduces on 34.12.0 which keeps analytics at 23.2.0)**

Additional: minSdk 26, targetSdk 36, Gradle 9.1.0, AGP 9.0.1, Kotlin 2.3.20.

### [REQUIRED] Step 3: Describe the problem

A `java.lang.SecurityException: GoogleCertificatesRslt: not allowed` is thrown on a Google Play Services internal `HandlerThread` during `zack.registerListener` after `zabq.onConnected`.

Crashes are exclusive to app version 1.5.0 (versionCode 17 + 18) — the first build to ship BoM **34.11.0**. The prior version 1.4.x (BoM **34.8.0**, analytics 23.0.0, identical Analytics code paths) shows **zero** crashes with this signature. The SHA-256 reported in the error matches our Play App Signing certificate, so these are not repackaged APKs; affected devices are stock retail flagships running Android 14/15/16: Samsung Galaxy S23 Ultra, S24 Ultra, S24+, Xiaomi Redmi 12, Tecno Camon 20 Pro. Affected GMS version on those devices: `261631035.true` (≈ 26.16.31).

BoM **34.12.0** does **not** bump `firebase-analytics` (still 23.2.0) and the signature continues unchanged on 34.12.0.

#### Steps to reproduce:

Not reproduced on internal QA devices — surfaces only in the field via Crashlytics. The trigger appears to be the GMS measurement client connecting and registering its listener for the first time during a session, not a specific `logEvent` callsite.

Observed conditions, all required together:

1. App built with Firebase BoM **34.11.0** or **34.12.0** (analytics / measurement-base 23.2.0).
2. Analytics initialized via `FirebaseAnalytics.getInstance(application)` + `setAnalyticsCollectionEnabled(true)`.
3. Stock retail device on Android 14/15/16 (e.g. Galaxy S23/S24 Ultra, S24+, Redmi 12, Camon 20 Pro).
4. Device GMS version `261631035.true` (≈ 26.16.31).

Crash signature from Crashlytics (package and SHA-256 redacted per org policy; can share privately if needed):

```
Fatal Exception: java.lang.SecurityException
GoogleCertificatesRslt: not allowed: pkg=, sha256=[], atk=false, ver=261631035.true (go/gsrlt)
at android.os.Parcel.createExceptionOrNull(Parcel.java:3354)
at android.os.Parcel.createException(Parcel.java:3338)
at android.os.Parcel.readException(Parcel.java:3321)
at android.os.Parcel.readException(Parcel.java:3263)
at com.google.android.gms.internal.measurement.zzbl.zzc(com.google.android.gms:play-services-measurement-base@@23.2.0:3)
at com.google.android.gms.internal.measurement.zzkt.zzj(zzkt.java:4)
at com.google.android.gms.internal.measurement.zzkg.accept(zzkg.java:2)
at com.google.android.gms.common.api.internal.zack.registerListener(zack.java:1)
at com.google.android.gms.common.api.internal.zabq.zaH(com.google.android.gms:play-services-base@@18.4.0:9)
at com.google.android.gms.common.api.internal.zabq.onConnected(com.google.android.gms:play-services-base@@18.4.0:2)
at com.google.android.gms.common.internal.zah.onConnected(zah.java:1)
at com.google.android.gms.common.internal.zzf.zza(com.google.android.gms:play-services-basement@@18.10.0:10)
at com.google.android.gms.common.internal.zza.zzc(zza.java:2)
at com.google.android.gms.common.internal.zzc.zzd(zzc.java:3)
at com.google.android.gms.common.internal.zzb.handleMessage(com.google.android.gms:play-services-basement@@18.10.0:33)
at android.os.Handler.dispatchMessage(Handler.java:110)
at android.os.Looper.loopOnce(Looper.java:273)
at android.os.Looper.loop(Looper.java:363)
at android.os.HandlerThread.run(HandlerThread.java:85)
```

We are planning to downgrade to BoM **34.10.0** to confirm the regression boundary, but would prefer a forward fix.

Question: is this a known regression in `play-services-measurement-base 23.2.0`'s GMS connection / listener-registration path, or in the GMS certificate-verification side it now invokes? If it's a GMS-side bug exposed by 23.2.0, what's the recommended path — pin to BoM 34.10.0 / analytics 23.0.0 until a fix ships, or wait for a specific GMS rollout?

#### Relevant Code:

The only Analytics setup in our DI graph:

```kotlin
@Provides
@Singleton
fun provideFirebaseAnalytics(application: Application): FirebaseAnalytics {
val analytics = FirebaseAnalytics.getInstance(application)
analytics.setAnalyticsCollectionEnabled(true)
return analytics
}
```

Standard `firebaseAnalytics.logEvent(name, bundle)` is used elsewhere. No Analytics-related manifest meta-data is set.