ci(security): disable vulnerable Kotlin cache paths

[papi-ux]

Summary

• disable KAPT incremental annotation-processing cache deserialization with kapt.incremental.apt=false while Nova remains on vulnerable Kotlin 2.3.21
• keep Gradle task-output caching disabled project-wide as defense in depth
• remove GitHub Actions Gradle User Home cache restore/save from build and CodeQL jobs
• disable caching inside the Gradle dependency-submission action while retaining dependency graph generation
• pass --no-build-cache explicitly to every CI Gradle invocation
• pin those boundaries with an executable contract that discovers every workflow and Gradle module, rejects command-line property overrides, and blocks unreviewed cache actions

Mitigates Dependabot alert #42 / CVE-2026-53914. The upstream fix hardens deserialization of KAPT's incremental java-cache.bin and apt-cache.bin.

Scope

This is a temporary pre-release containment, not a claim that the vulnerable Kotlin plugin has been upgraded. Nova does not currently apply KAPT, so the known vulnerable path is not reachable in the present build; the explicit property keeps it fail-closed if KAPT is introduced before the toolchain upgrade.

Maven Central currently has patched 2.4.20 builds only through 2.4.20-RC. Nova stays on stable 2.3.21 until the Kotlin/Compose/AGP combination can be upgraded and qualified together.

The Dependabot alert should remain open until a stable patched Kotlin release replaces this mitigation.

Verification

Exact head: 9d021fc2e4833f3287a89365a9b81927bea14129, based on master befb1f4824eb2b2c6be6bff2de9cc509f46d0132.

Fedora verifier with an initialized native submodule and the Android SDK:

• RED on untouched master with the original contract: failed because org.gradle.caching=true
• RED on the first mitigation with the corrected KAPT contract: failed because kapt.incremental.apt=false was absent
• GREEN after the corrected mitigation: focused cache contract 1/1
• full JVM suite: 1360 tests, 0 failures/errors/skips
• helper/onboarding Python suite: 51/51
• Android lint: successful with the repository's existing baseline
• all edited workflow YAML parses successfully
• actionlint clean except for the repository's pre-existing SC2012 finding
• git diff --check clean

Protected exact-head CI passed: Build Nova APK (lint, JVM tests, helper tests, and release assembly), CodeQL, and Public Hygiene.