fix(android): Wire dependencies report through asset transform task

[runningcode]

Summary

• Removes addGeneratedSourceDirectory call that exposed a task-backed Provider<Directory> via variant.sources.assets?.all, causing configuration-time errors for plugins like Paparazzi that query asset sources before tasks execute
• Instead wires the dependencies report (sentry-external-modules.txt) through the existing InjectSentryMetaPropertiesIntoAssetsTask, which already transforms SingleArtifact.ASSETS and copies all assets into the output directory
• configureDependenciesTask() now returns the task provider, and InjectSentryMetaPropertiesIntoAssetsTask gains an optional dependenciesReportDir input that copies the report files into the transformed assets output

🤖 Generated with Claude Code

[github-actions]

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

Bug Fixes 🐛

• (android) Wire dependencies report through asset transform task by runningcode in #1115

Internal Changes 🔧

• Pin GitHub Actions to full-length commit SHAs by joshuarli in #1116

---

_{🤖 This preview updates automatically when you update the PR.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Missing output directory for dependencies report task
  • Added explicit output directory configuration using project.layout.buildDirectory.dir() to set the required output property on SentryExternalDependenciesReportTaskV2.

Or push these changes by commenting:

@cursor push 2904c9c146

Preview (2904c9c146)

diff --git a/plugin-build/src/main/kotlin/io/sentry/android/gradle/AndroidComponentsConfig.kt b/plugin-build/src/main/kotlin/io/sentry/android/gradle/AndroidComponentsConfig.kt
--- a/plugin-build/src/main/kotlin/io/sentry/android/gradle/AndroidComponentsConfig.kt
+++ b/plugin-build/src/main/kotlin/io/sentry/android/gradle/AndroidComponentsConfig.kt
@@ -342,6 +342,7 @@
   sentryTelemetryProvider: Provider<SentryTelemetryService>,
 ): TaskProvider<SentryExternalDependenciesReportTaskV2>? {
   if (extension.includeDependenciesReport.get()) {
+    val outputDir = project.layout.buildDirectory.dir("generated${sep}sentry${sep}dependencies${sep}${name}")
     val reportDependenciesTask =
       SentryExternalDependenciesReportTaskV2.register(
         project = project,
@@ -349,6 +350,7 @@
         sentryTelemetryProvider,
         configurationName = "${name}RuntimeClasspath",
         attributeValueJar = "android-classes",
+        output = outputDir,
         includeReport = extension.includeDependenciesReport,
         taskSuffix = name.capitalized,
       )

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[romtsn]

LGTM with one thing to address!

[github-actions]

• 🚫 The changelog entry seems to be part of an already released section ## 6.2.0.
  Consider moving the entry to the ## Unreleased section, please.

[romtsn]

could you maybe extract this into OutputPaths to not diverge from the existing pattern?