[oudaykhaled]

Summary

Complete the existing TransferFlow portfolio app with a reviewable demo and installation path. This focused follow-up changes eight authored files/assets; no generated build trees or APKs enter Git.

• Add a genuine landscape/portrait regression through draft, review and unresolved recovery, retaining the original persisted request and operation.
• Publish the installable debug demo APK and SHA-256 checksum from CI with commit identity and 14-day retention.
• Add an 85-second actual-app GIF showing lost response, cold restart and safe retry, plus exact recording context.
• Document dependency compatibility, upgrade gates, artifact download/install and executed verification.

Verification

• Local combined gate: 83 JVM + 11 device tests; zero failures/errors/skips, API 35 arm64.
• Debug and minified unsigned release build; lint 0 errors / 10 existing warnings.
• Real debug app cold restart changed PID 4975 to 5473; original unresolved outcome restored and safe retry confirmed. Subsequent account inspection: €12,455.55 from €12,480.55, one €25 history row.
• GIF frames, local documentation links, workflow invariants and git diff --check inspected. Three parallel agents independently reviewed test, delivery and scope.
• Hosted run 37968881410 passed both jobs on source head a059605e77a2f55df6051acf37a65d34a6a5f83d (checked-out PR merge b90ea7f75c7200c7309e409ce4ac3a008b7f19db). Downloaded XML independently confirms 83 JVM + 11 API 35 x86_64 device tests; zero failures/errors/skips. Hosted lint: 0 errors / 10 warnings.
• Installable demo APK + checksum downloaded and verified with shasum and apksigner; installation, fresh account launch and €25/€0 fee review succeeded on the task-owned API 35 arm64 emulator. APK SHA-256: bf753f55ed8e01892de7b3127891bc7e6351762b4f9b611982517df5ecf8d640.
• Artifact expires 23 October 2026 at 17:52:09 UTC and requires GitHub sign-in. Its name identifies the generated PR merge commit, not a merged PR.

Review scope and boundaries

All fixtures are synthetic. No real bank/authentication or production security claim. The local gateway is a separate Room ledger, not a remote security boundary. TalkBack, physical/OEM devices and the wider API matrix remain unexecuted.

The GIF is silent, normal speed, resized/palette-converted without cuts; it ends at the confirmed outcome. The later account check is separate. This PR retains the accepted money/idempotency/persistence design and pinned dependency matrix.

No merge requested or performed. The unrelated major-toolchain Dependabot PR is left for a separate compatibility review.