fix(mobile): resolve Android dependencies through Artifactory

[brow]

What changed?

Buzz Android now resolves Maven Central and Gradle Plugin Portal dependencies through Block Artifactory's square-public repository. Google-hosted Android dependencies continue to use google().

Why?

Shared CI egress is currently rate-limited by Maven Central with HTTP 429 responses, blocking signed Android release bundles. Using Block's mirror removes that direct dependency while keeping the resolved artifacts unchanged.

How is it tested?

• Clean Gradle dependency resolution through Artifactory
• Full mobile analysis and test suite
• Full pre-push validation

🤖 This PR was authored with an agent.

[brow]

@codex review

[brow]

@builderbot review

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.

[brow]

🤖 This makes an internal-only host the sole plugin repository in a public OSS project. The public GitHub-hosted Mobile job now fails here after seven minutes because it cannot resolve org.jetbrains.kotlin.android:org.jetbrains.kotlin.android.gradle.plugin:2.2.20, while the same artifact returns 200 on a Block-connected machine. global.block-artifacts.com publicly resolves to RFC1918 10.172.x addresses, so anonymous authorization does not make it publicly reachable. Please keep a public repository path for external contributors, or scope this mirror override to Block release CI.

[brow]

🤖 Independent review at exact head 7ea5964. Verdict: block as written — concurring with the existing blocking inline comment, via independent evidence.

• Root problem, confirmed independently: global.block-artifacts.com publicly resolves through proxy.block-artifacts.com to RFC1918 addresses (10.172.x / 10.164.x via both dns.google and Cloudflare DoH). Anonymous authorization on square-public is real (the Kotlin 2.2.20 plugin marker and kotlin-gradle-plugin POMs return HTTP 200 from a Block-connected machine, and the Artifactory API shows square-public as a virtual maven repo), but network reachability is Block-only. block/buzz is a public repo; this change makes an intranet-only host the sole source for Maven Central and Plugin Portal artifacts.
• Observed breakage at this head: the public ubuntu-latest Mobile job failed after ~7 minutes at settings.gradle.kts line 19: org.jetbrains.kotlin.android:2.2.20 "was not found in any of the following sources: Google, maven(https://global.block-artifacts.com/artifactory/square-public)". Same failure would hit every external contributor and fork.
• Why local validation didn't catch it: resolution succeeds from inside the Block network, so the clean 1,533-request local run was environment-dependent, not evidence for CI. Worth remembering for any future mirror change in a public repo.
• Correct scope for the underlying need: the release-pipeline-side fix (squareup/buzz-releases#72) routes only the internal release job through Artifactory and leaves this public repo's defaults intact. If this PR is reworked, it needs the mirror to be conditional/opt-in (e.g., env- or property-gated repo, or Central kept as fallback) so public builds keep working; that also implies adding back gradlePluginPortal() semantics for OSS contributors.

Keep as draft; not suitable to gate the Android release.