feat(audience): resolve install referrer via Maven instead of bundling the AAR

Bundled AARs can't be de-duplicated by Gradle, so shipping
installreferrer-2.2.aar directly caused class/version conflicts when a
game pulled the same library in via another SDK. Declare it as a Maven
dependency through EDM4U (Editor/ImmutableAudienceDependencies.xml) and
document a manual mainTemplate.gradle fallback for projects without EDM4U.
The AUDIENCE_MOBILE_ATTRIBUTION define still gates the C# JNI code; the
defensive proguard keep-rules are retained.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: nattb8

src/Packages/Audience/Editor/ImmutableAudienceDependencies.xml

@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  External Dependency Manager for Unity (EDM4U) dependency declaration.
+
+  The Google Play Install Referrer Library is resolved from Maven instead of
+  being bundled as a prebuilt .aar. Bundled .aars cannot be de-duplicated by
+  Gradle, so shipping installreferrer-2.2.aar directly caused class/version
+  conflicts when a game already pulled in the same library via another SDK.
+  Declaring it here lets Gradle's resolver pick a single, highest version.
+
+  Requires EDM4U (com.google.external-dependency-manager) in the project.
+  Studios that do not use EDM4U should instead add the dependency manually:
+
+      // Assets/Plugins/Android/mainTemplate.gradle, dependencies { }
+      implementation 'com.android.installreferrer:installreferrer:2.2'
+
+  play-services-ads-identifier (GAID) is intentionally NOT declared here - it
+  is left for the studio to add so that games which do not collect the
+  advertising ID never declare the AD_ID permission. See AndroidManifestPostProcessor.
+-->
+<dependencies>
+  <androidPackages>
+    <androidPackage spec="com.android.installreferrer:installreferrer:2.2">
+      <repositories>
+        <repository>https://maven.google.com</repository>
+      </repositories>
+    </androidPackage>
+  </androidPackages>
+</dependencies>

src/Packages/Audience/Editor/ImmutableAudienceDependencies.xml.meta

@@ -47,17 +47,29 @@ Press Play; `ImmutableAudience.Initialized` returns `true` and `AnonymousId` bec
 - Integration guide and API reference: <https://docs.immutable.com/docs/products/audience/unity-sdk>
 - Sample Unity project: [`examples/audience`](https://github.com/immutable/unity-immutable-sdk/tree/main/examples/audience)
 
-## Vendored dependencies
+## Android dependencies
 
-The package vendors prebuilt third-party AARs for mobile attribution. They are only included in your build when the corresponding scripting define is set; without the define they're stripped via `defineConstraints` on the plugin meta files.
+Mobile install attribution (the `AUDIENCE_MOBILE_ATTRIBUTION` define) needs the Google Play Install Referrer Library. The package does **not** bundle it as a prebuilt `.aar` — bundled AARs can't be de-duplicated by Gradle, so shipping `installreferrer-2.2.aar` directly caused class/version conflicts when a game already pulled in the same library via another SDK. Instead it's resolved from Maven:
 
-| File | Version | Source | Required define |
-| --- | --- | --- | --- |
-| `Runtime/Plugins/Android/installreferrer-2.2.aar` | 2.2 | [maven.google.com](https://maven.google.com/web/index.html#com.android.installreferrer:installreferrer:2.2) | `AUDIENCE_MOBILE_ATTRIBUTION` |
+| Dependency | Version | Source |
+| --- | --- | --- |
+| `com.android.installreferrer:installreferrer` | 2.2 | [maven.google.com](https://maven.google.com/web/index.html#com.android.installreferrer:installreferrer:2.2) |
 
-`Runtime/Plugins/Android/proguard-user.txt` ships explicit R8 keep rules for the Install Referrer Library. Unity's gradle build merges it automatically when the AAR is included.
+**With [EDM4U](https://github.com/googlesamples/unity-jar-resolver) (recommended):** no action needed. `Editor/ImmutableAudienceDependencies.xml` declares the dependency and EDM4U's Android Resolver fetches it, resolving any version conflict with other SDKs to a single highest version. Install EDM4U as a project prerequisite — do not embed a second copy.
 
-Before tagging a release, check `maven.google.com` for newer versions of any vendored dependency and bump the pinned filename if needed.
+**Without EDM4U:** add the dependency to your `Assets/Plugins/Android/mainTemplate.gradle`:
+
+```gradle
+dependencies {
+    implementation 'com.android.installreferrer:installreferrer:2.2'
+}
+```
+
+`Runtime/Plugins/Android/proguard-user.txt` ships explicit R8 keep rules for the Install Referrer Library; Unity's gradle build merges them regardless of how the dependency is resolved.
+
+`play-services-ads-identifier` (GAID) is intentionally left for the studio to add, so games that don't collect the advertising ID never declare the `AD_ID` permission.
+
+Before tagging a release, check `maven.google.com` for a newer version and bump the pinned version above and in `ImmutableAudienceDependencies.xml` if needed.
 
 ## License
 

src/Packages/Audience/README.md

@@ -1,6 +1,7 @@
 # Keep Google Play Install Referrer Library symbols.
 #
-# The AAR (installreferrer-2.2.aar) ships consumer rules in
+# The installreferrer AAR (resolved from Maven via EDM4U or a manual gradle
+# dependency - see README) ships consumer rules in
 # META-INF/com.android.tools/proguard/proguard.txt and Unity's gradle build
 # auto-merges them, but R8 fullMode in Unity 2022.3+ has been observed to
 # discard merged consumer rules in some studio configurations. These