Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

These three capture methods had their beforeSend* executors wrapped by the
re-entrancy guard but no entry check, so they were never dropped when a
callback was active. That broke the "callbacks never nest" invariant: a
callback that captured feedback/replay/metric ran that executor, whose exit()
cleared the shared flag mid-callback, re-enabling recursion for any
captureEvent/captureLog that followed in the same callback. They also recursed
directly (e.g. beforeSendFeedback -> captureFeedback).

Add the same isActive() entry guard to all three so every executor-wrapped
capture path also drops while a callback runs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…g callbacks

Two robustness fixes for the callback re-entrancy guard:

Replace the boolean flag with a depth counter so a nested exit() cannot
disarm the guard while an outer callback is still running. The boolean
relied on the "callbacks never nest" invariant, which every capture entry
point must uphold by convention - a future capture path added without an
entry check would silently re-open the recursion hole. The counter makes
that failure mode structurally impossible, and lets exit() remove() the
thread-local entry instead of parking a stale value on pooled threads.

Wrap beforeErrorSampling and beforeEnvelopeCallback, the two remaining
user callbacks in SentryClient without enter()/exit(). A capture from
within beforeErrorSampling recursed unguarded (captureEvent ->
beforeErrorSampling -> captureEvent -> ...). Both regression tests were
verified to fail with StackOverflowError without the wraps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Replace the manual enter()/finally-exit() pattern at every callback site
with an ISentryLifecycleToken returned from enter(), used via
try-with-resources. This removes nine copies of the finally boilerplate
and the risk of forgetting the exit() call.

The depth counter stays as the guard's state model - the token's close()
just decrements it - so the nesting correctness guarantee is unchanged.
The token is a shared static singleton, so no allocation happens per
callback, matching the AutoClosableReentrantLock idiom already in the
codebase.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The rebase folded the previous Unreleased section into the released
8.48.0, stranding the callback re-entrancy entry there. Move it back
under Unreleased.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

captureEnvelope and captureCheckIn route into sendEnvelope without the
isActive() entry check every other capture path has. A beforeEnvelope
callback that itself captured an envelope or check-in re-entered
sendEnvelope, re-ran the callback, and recursed to a StackOverflowError -
the same failure class the rest of this PR fixes.

Check the guard at the top of sendEnvelope, the single choke point every
send flows through, rather than adding a check to each public entry
point. In normal flow the guard is already inactive there (the before*
callback has exited), so an active guard can only mean a callback
triggered the send, which is dropped. This also closes the hole for any
future sender routed through sendEnvelope.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

captureCheckIn and captureEnvelope both funnel into sendEnvelope and hit
the same isActive() guard, so the check-in test exercised no code path
the envelope test did not already cover.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The re-entrancy guard dropped nested captures but logged a DEBUG line at
seven of the eight drop sites. That log is itself routed back into Sentry
by the same logging integrations this guard protects against (the Gradle
plugin's logcat instrumentation feeds captureLog, whose own drop logs
again), so logging on the drop path re-opens the very recursion the guard
breaks. It only bites with SDK debug logging enabled, since the internal
logger is otherwise a no-op, but dropping silently removes the failure
mode outright.

Drop without logging everywhere and document why in the guard's Javadoc
and at each drop site.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

A customer implementing beforeSend/beforeBreadcrumb/beforeSendLog/etc.
has no way to know that capturing from within the callback — directly or
through a logging integration — is silently dropped to prevent recursion.
State the contract on each customer-facing callback interface.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The token refactor changed SentryCallbackReentrancyGuard.enter() to
return an ISentryLifecycleToken and made exit() private, but the API dump
was not regenerated at the time. The guard is @ApiStatus.Internal.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>