fix(android): inject webview script at document start

[davidmurdoch]

Description

Patches @metamask/react-native-webview@14.6.0 on Android so injectedJavaScriptBeforeContentLoaded uses AndroidX WebViewCompat.addDocumentStartJavaScript when WebViewFeature.DOCUMENT_START_SCRIPT is supported.

The patch registers the document-start script before loadSource, refreshes the registration when relevant props change, preserves the existing evaluateJavascript path as the unsupported-device fallback, and keeps the default main-frame-only behavior with a small frame guard.

Validation so far:

• patch -d /tmp/rnw-mm-doc-start-verify -p4 --dry-run -i patches/@metamask+react-native-webview+14.6.0.patch
• Static Node invariant check for the patch contents
• yarn jest scripts/react-native-webview-document-start-patch.test.ts --runInBand could not run locally because this checkout has no node_modules state file

Changelog

CHANGELOG entry: null

Related issues

Fixes: N/A

Manual testing steps

Feature: Android WebView document-start provider injection

  Scenario: dapp inline script checks the provider during document start
    Given the Android WebView implementation supports DOCUMENT_START_SCRIPT
    And a browser tab loads a dapp whose first inline script checks window.ethereum

    When the dapp document begins loading
    Then the injected provider script runs before the dapp inline script continues

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I have followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I have completed the PR template to the best of my ability
• I have included tests if applicable
• I have documented my code using JSDoc format if applicable
• I have applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I have tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I have tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I have instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I have manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[davidmurdoch]

I have read the CLA Document and I hereby sign the CLA

[davidmurdoch]

Replaced by #29821, which uses an upstream MetaMask branch so trusted CI can run.