* fix(android): harden canvas webview bridge * fix(android): make canvas content access hardening explicit * fix(android): keep webview hardening inline for CodeQL * fix(android): avoid webview getter false positive
Add a manual Android CodeQL security shard scoped to app production sources. Verified with profile=android-security on Blacksmith in 4m22s.