feat: upgrade build environment to JDK 21 and centralize CI configuration

- Create a composite GitHub Action `gradle-setup` to encapsulate code checkout, wrapper validation, JDK 21 setup, and Gradle caching logic.
- Update all GitHub workflows (`publish-core`, `codeql`, `scheduled-updates`, `release`, etc.) to utilize the new centralized `gradle-setup` action.
- Upgrade the project's primary JDK requirement from 17 to 21 across `jitpack.yml`, workflow files, and build-logic conventions.
- Refactor `KotlinAndroid.kt` and `build.gradle.kts` to target JVM 21 for the application while maintaining JVM 17 compatibility for published library modules (`api`, `model`, `proto`).
- Introduce a new `build-desktop` job in `reusable-check.yml` to verify desktop artifact assembly during CI.
- Implement dynamic `cache_read_only` detection in workflows to optimize Gradle cache usage across different branch types and merge groups.
- Update project documentation (`GEMINI.md`, `AGENTS.md`, `CONTRIBUTING.md`) to reflect the JDK 21 requirement and provide guidance on Robolectric configuration for the new version.

.github/actions/gradle-setup/action.yml

@@ -0,0 +1,38 @@
+name: Gradle Setup
+description: Setup Java and Gradle for KMP builds
+inputs:
+  cache_read_only:
+    description: 'Whether Gradle cache is read-only'
+    default: 'true'
+  jdk_distribution:
+    description: 'JDK distribution (temurin or jetbrains)'
+    default: 'temurin'
+runs:
+  using: composite
+  steps:
+    - name: Checkout code
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+        submodules: 'recursive'
+
+    - name: Validate Gradle Wrapper
+      uses: gradle/actions/wrapper-validation@v6
+
+    - name: Set up JDK 21
+      uses: actions/setup-java@v5
+      with:
+        java-version: '21'
+        distribution: ${{ inputs.jdk_distribution }}
+        token: ${{ github.token }}
+
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v6
+      with:
+        cache-read-only: ${{ inputs.cache_read_only }}
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+        cache-cleanup: on-success
+        build-scan-publish: true
+        build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
+        build-scan-terms-of-use-agree: 'yes'
+        add-job-summary: always