Summary

Latent twin of d4rken-org/octi#284 — same NavigationController design (@Singleton + nullable _backStack + strict error("...not initialized")), same Compose setContent { } registration pattern, same race surface.

MainActivity.onNewIntent calls consumeUpgradeExtra(intent), which in turn calls navCtrl.goTo(Nav.Main.Upgrade). If onNewIntent fires before the setContent { } lambda has run (e.g. during activity recreation from a config change, or singleTask warm intent delivery on a slow device), _backStack is still null and the goTo throws IllegalStateException.

This PR mirrors the fix shipped to Octi: defer the navigation step until a Compose-side collector picks it up.

Changes

• New private MainActivity.warmIntents: SingleEventFlow<Intent> field
• onNewIntent now just calls setIntent(intent) and warmIntents.tryEmit(intent) — no navCtrl interaction
• The existing LaunchedEffect(Unit) inside setContent extends to also warmIntents.collect { newIntent -> consumeUpgradeExtra(newIntent) } after handling the cold-start intent
• NavigationController is unchanged — strict contract preserved

The race window is tight (it requires onNewIntent to fire between setContent returning and the Compose lambda running), so this is a latent crash with no Play Store report yet — but the same code path crashed Octi on Android 16 Beta. Fixing here pre-emptively.

Test plan

• ./gradlew :app:testFossDebugUnitTest passes
• ./gradlew :app:assembleFossDebug compiles cleanly
• Manual: launch the upgrade flow via the existing pathway that fires EXTRA_NAVIGATE_TO_UPGRADE (e.g. via EXTRA_UPGRADE_FOR_RESULT flow or the link that triggers it) — confirm Upgrade screen still opens