Bump to v1.0.11 (#752)

Answers the 2026-09-14 source audit on MR !42096. Everything below is already
on main; this pins it to a tag F-Droid can point at.

- The "Allow AI to act on notifications" and "Allow DND changes" switches
  were stored but never consulted by the production providers, so both tool
  families stayed live with the switch off. On 1.0.10 set_dnd_state returned
  success and actually silenced the phone. (#746, #748)
- HttpHeaderInjector buffered the header block and chunk-size line with no cap
  ahead of Ktor, so Ktor's limits never applied. Measured: 16,793,629 bytes
  retained, nothing emitted, no exception. (#749, #750)
- Refresh-token rotation was read -> check -> write with nothing holding the
  gap; 199 of 200 rounds minted two descendants. Now a single CAS UPDATE.

Also carries the listing and privacy corrections promised on 09-10 but landed
after the 1.0.10 tag, so the pinned tree never contained them: full_description
said the certificate check "Runs on an interval you pick, or not at all" when
it ships on at 12 hours. (#743, #744)


Claude-Session: https://claude.ai/code/session_01YYSPuh9bZEJkrzvnEpY1QK

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

app/build.gradle.kts

@@ -192,8 +192,8 @@ android {
         applicationId = "com.rousecontext"
         minSdk = 24
         targetSdk = 36
-        versionCode = 11
-        versionName = "1.0.10"
+        versionCode = 12
+        versionName = "1.0.11"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 

fastlane/metadata/android/en-US/changelogs/12.txt

@@ -0,0 +1,8 @@
+The notification and Do Not Disturb switches now actually gate what the AI can do.
+
+Turning off "Allow AI to act on notifications" or "Allow DND changes" left the
+matching tools working anyway. Both switches are now read where the tools are
+built, so off means off.
+
+A connection that sends an endless HTTP header is dropped instead of buffered,
+and refreshing a token can no longer mint two replacements at once.

fdroid/com.rousecontext.yml

@@ -226,9 +226,8 @@ MaintainerNotes: |-
     Variant facts (do not regress):
       * Bare build = FOSS (UnifiedPush + ACRA, no Firebase/GMS). `-Pgoogle` is
         the Firebase build and must NOT be used for F-Droid.
-      * Toolchain at v1.0.8: AGP 8.13.2, Kotlin 2.2.21, JDK 21, compileSdk 36,
-        minSdk 24, targetSdk 36 (raised after v1.0.8; ships in the next
-        release), Gradle 8.14.3.
+      * Toolchain at v1.0.11: AGP 8.13.2, Kotlin 2.2.21, JDK 21, compileSdk 36,
+        minSdk 24, targetSdk 36 (raised from 35 in v1.0.11), Gradle 8.14.3.
       * FOSS-only runtime deps: UnifiedPush connector 2.5.0, ACRA 5.13.1.
 
     On bump: update versionName/versionCode here and in CurrentVersion(Code)