Upgrade Kotlin Gradle plugin past CVE-2026-53914

[aspix2k]

Problem

The project build still pins org.jetbrains.kotlin.jvm 2.4.10. GitHub Dependabot alert #9 reports org.jetbrains.kotlin:kotlin-gradle-plugin < 2.4.20-Beta1 as vulnerable to CVE-2026-53914 / GHSA-r937-wjx7-w2jp (unsafe build-cache deserialization with code-execution impact).

Acceptance criteria

• The production build uses an officially published Kotlin Gradle plugin version at or above 2.4.20-Beta1.
• The selected patched preview is bound to its official Plugin Portal publication and the advisory lower bound.
• Release currentness fails closed if the approved preview disappears, falls below the patched minimum, or a patched stable 2.4.20+ becomes available.
• Regression tests cover the accepted preview, an unpublished preview, a below-minimum preview and stable-replacement expiry.
• GitHub Dependabot alert ci: bump gradle/actions/setup-gradle from 4.3.1 to 6.3.0 #9 becomes fixed after the dependency graph refreshes.
• No workflow changes; CI ownership remains with Grok.

References: GHSA-r937-wjx7-w2jp, Kotlin Gradle plugin.