fix(ci): install the Android SDK with setup-android v4

[Viserion77]

Summary

• Bumps android-actions/setup-android from v3 to v4 in the kotlin job.
• Every CI run has been red since 2026-09-28 — on main and on every open PR —
  and none of them failed for a reason in this repository. The v3 default for
  the action's packages input is 'tools platform-tools', and Google stopped
  serving the deprecated tools package around 2026-09-15, so sdkmanager exits
  1 with Failed to find package 'tools' before a line of Kotlin is compiled.
  v4 dropped tools from the default and skips it with a warning when asked
  for it explicitly, which makes this a drop-in bump: the only thing that stops
  being installed is a package that no longer exists.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm build — plus build:site, codegen:native:check,
  typecheck:strict-templates, check:theme and test:e2e (11/11)
• cd packages/egui && cargo fmt --check && cargo clippy --all-targets -D warnings && cargo test --all
• cd packages/compose && ./gradlew clean build against a real Android SDK —
  BUILD SUCCESSFUL, 98 tasks, no warnings. The port itself was never broken.

Notes

• Accessibility considerations: none — CI configuration only, no shipped code.
• Follow-up work:
  • PR chore(deps-dev): bump vitest from 3.2.7 to 4.1.11 #67 (vitest 3.2.7 → 4.1.11) stays red after this lands, for an unrelated
    reason: it bumps vitest alone and leaves @vitest/coverage-v8 (root) and
    @vitest/browser (apps/docs) on ^3.2.7. The suite runs, then the v8
    coverage provider dies with Cannot read properties of undefined (reading 'fetchCache'). The three move together or not at all.
  • PRs chore(deps): bump the production-dependencies group across 1 directory with 6 updates #69 and chore(deps-dev): bump the dev-dependencies group across 1 directory with 16 updates #70 were only ever failing on this job and should go green on rebase.
  • .github/dependabot.yml ignores every major for github-actions
    ("Major upgrades reviewed manually"), which is why v4 was never proposed.
    The rule is deliberate; what is missing is the periodic manual review.