[TheCryptoDonkey]

Summary

• move authenticated audio/video attachment playback into a dedicated same-UID process
• stream bounded plaintext through sealed read-only shared memory, with Compose controls and a cross-process Surface
• add corrupt/truncated media, lifecycle and minified-release emulator coverage

Security boundary

This contains media-client crashes; it is not an isolated-UID confidentiality boundary. Android 15 denies isolated UIDs access to platform media services, which provide sandboxed demuxing/decoding.

Verification

• Android 15 recording suite: 30 tests
• Minified-release signing lineage, native WebRTC, six image, three recording-service and four recording UI tests
• Full integrated Gradle suite and hosted CI running on this PR

Physical GrapheneOS audio/video, seeking, process-death, memory-pressure and active-call acceptance remain open.