Close the classpath gap in invariant 13, harden three Konsist rules

[simtop]

Summary

• checkDataLayerClasspathBoundary: a new Gradle task, wired into check on both feature convention plugins, that resolves each feature module's actual debugCompileClasspath and fails if a data-layer module (:beer_data/:beer_database/:beer_network) shows up in it. FeatureDataLayerBoundaryTest only reads a feature's own build-script text, so a data-layer module arriving through an intermediate dependency's api(...) declaration was invisible to it - verified empirically (a temporary api(...) probe on :presentation_utils reproduced and was caught; an implementation(...) probe correctly did not, since Gradle's own configuration elision already keeps that off the compile classpath). CI never invokes the check lifecycle task on any module, so this is also wired into make check-data-layer-boundary and called directly in the same CI job as make konsist.
• Three Konsist rules with hardcoded module-path / plugin-id lists (FeatureDataLayerBoundaryTest, DevAppDependencyBoundaryTest, InstrumentedTestOptInBoundaryTest) now carry a positive-control test: each list's strings are checked against the filesystem / convention-plugin files they're supposed to name, so a typo or a rename fails loudly instead of silently turning the rule into a no-op that still reports green.
• gradle.properties: turns off codegen for shaders, the one AGP build feature that still has a live global default flag on this AGP version (checked against AGP's own BooleanOption class - buildconfig/aidl/renderscript are already unconditionally off on AGP 9).
• AGENTS.md invariant 13 updated to describe the classpath backstop.

Test plan

• ./gradlew :konsist:test - all rules pass, including the three new positive-control tests
• ./gradlew checkDataLayerClasspathBoundary - passes on all four feature modules
• Verified the check actually fails: temporarily added api(project(":beer_data")) to :presentation_utils, confirmed checkDataLayerClasspathBoundary failed with the expected message, reverted
• Verified the check doesn't false-positive on the dynamic-feature :app edge (implementation(project(":app")))
• ./gradlew spotlessCheck detekt - clean
• ./gradlew compileDebugKotlin - full project compiles
• Confirmed classify_path in detect-change-scope.sh runs the unit-tests lane (where this new CI step lives) on any build.gradle.kts-only change