ci: check the Kotlin pin and refuse a dirty repro build

Every other version repeated outside ./versions is asserted in test.sh.
KOTLIN_VERSION was not, so bumping it would leave a stale version in a
license notice with nothing to catch it.

In verify-repro the two git diff calls preceded the status check, so
under set -eu a dirty tree exited 1 with no output and the message below
was never reached. git status --porcelain already covers staged,
unstaged and untracked changes.

2 files changed, 1 insertions, 2 deletions

diff --git a/ci/test.sh b/ci/test.sh
index e3e728c..d70b8f2 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -51,6 +51,7 @@ line THIRD_PARTY "- rsync ${RSYNC_VERSION}, GPLv3. Source: https://download.samb
 line THIRD_PARTY "- The Go standard library from Go ${GO_VERSION}, BSD 3-clause."
 line THIRD_PARTY "- golang.org/x/crypto ${X_CRYPTO_VERSION}, BSD 3-clause."
 line THIRD_PARTY "APK. golang.org/x/sys ${X_SYS_VERSION} is an indirect module-graph dependency but no"
+line THIRD_PARTY "- Kotlin standard library ${KOTLIN_VERSION} and kotlinx.coroutines 1.9.0, Apache 2.0."
 line THIRD_PARTY "- AndroidX Core ${ANDROIDX_CORE_VERSION}, AppCompat ${ANDROIDX_APPCOMPAT_VERSION}, and WorkManager ${ANDROIDX_WORK_VERSION},"
 cmp "$root/APACHE-2.0" "$root/app/src/main/assets/APACHE-2.0" || {
 	echo "ci: packaged APACHE-2.0 differs from repository APACHE-2.0" >&2
diff --git a/ci/verify-repro.sh b/ci/verify-repro.sh
index 605ec77..36d1f51 100755
--- a/ci/verify-repro.sh
+++ b/ci/verify-repro.sh
@@ -11,8 +11,6 @@ trap 'rm -rf "$tmp"' 0 1 2 3 15
 a="$tmp/a/src"
 b="$tmp/a-much-longer-path/b/src"
 
-git -C "$root" diff --quiet
-git -C "$root" diff --cached --quiet
 status=$(git -C "$root" status --porcelain --untracked-files=normal)
 [ -z "$status" ] || {
 	echo "verify-repro: tracked and untracked source must be clean" >&2