build: guard local gradle runs against exhausting the box

The devshell `gradle` now serialises local builds with flock and runs
them under `nice` with capped workers, so several agents building at
once queue instead of piling up daemons and compile workers and taking
the machine down. With CI/GITHUB_ACTIONS set it execs Gradle directly,
leaving CI untouched. Also shorten the Gradle daemon idle timeout so
idle daemons are reaped sooner.

flake.nix

@@ -40,9 +40,17 @@
           };
           androidSdk = android.androidsdk;
 
+          gradle_wrapper = pkgs.writeShellScriptBin "gradle" ''
+            if [ -n "''${CI:-}''${GITHUB_ACTIONS:-}" ]; then
+              exec ${pkgs.gradle_9}/bin/gradle "$@"
+            fi
+            exec ${pkgs.util-linux}/bin/flock /tmp/subtracks-gradle.lock \
+              ${pkgs.coreutils}/bin/nice -n 10 ${pkgs.gradle_9}/bin/gradle --max-workers=4 "$@"
+          '';
+
           basePackages = [
             pkgs.jdk21
-            pkgs.gradle_9
+            gradle_wrapper
             pkgs.git
             pkgs.curl
             pkgs.unzip