build: harden the gradle guard wrapper

- cap workers via GRADLE_OPTS instead of a CLI flag, so a caller passing
  --max-workers no longer collides and fails the build
- keep the lock under $XDG_RUNTIME_DIR (falling back to ~/.cache) rather
  than a world-writable /tmp path
- let --stop/--status/--version bypass the lock, and announce when a build
  is waiting for it
- drop the redundant GITHUB_ACTIONS check; the CI runners all set CI

AGENTS.md

@@ -14,7 +14,7 @@ Everything comes from the Nix flake devshell; do not install toolchains by hand.
 - The default devshell provides JDK 21, Gradle 9, the Android SDK (platform 37, build-tools 37.0.0, platform-tools 37.0.1) and nushell.
 - The integration harness needs real servers, so it lives in a separate `nix develop .#integration` shell (navidrome, gonic, lms, php, Nextcloud with the Music app, sqlite). Keeping them out of the default shell avoids pulling that closure into everyday builds.
 - Build with the devshell `gradle`, not `./gradlew`. CI uses the nix Gradle pinned by `flake.lock`; the wrapper is kept only for people without Nix.
-- The devshell `gradle` is a wrapper: outside CI it takes a lock (`flock /tmp/subtracks-gradle.lock`) and runs under `nice` with capped workers, so several agents building at once queue instead of exhausting the box. With `CI`/`GITHUB_ACTIONS` set (i.e. CI) it execs Gradle directly, unchanged.
+- The devshell `gradle` is a wrapper: outside CI it takes a lock (under `$XDG_RUNTIME_DIR`, falling back to `~/.cache`) and runs under `nice` with a capped worker count, so several agents building at once queue instead of exhausting the box. `--stop`/`--status`/`--version` bypass the lock; with `CI` set it execs Gradle directly, unchanged.
 
 ## Commands
 

flake.nix

@@ -41,11 +41,25 @@
           androidSdk = android.androidsdk;
 
           gradle_wrapper = pkgs.writeShellScriptBin "gradle" ''
-            if [ -n "''${CI:-}''${GITHUB_ACTIONS:-}" ]; then
+            if [ -n "''${CI:-}" ]; then
               exec ${pkgs.gradle_9}/bin/gradle "$@"
             fi
-            exec ${pkgs.util-linux}/bin/flock /tmp/subtracks-gradle.lock \
-              ${pkgs.coreutils}/bin/nice -n 10 ${pkgs.gradle_9}/bin/gradle --max-workers=4 "$@"
+            for arg in "$@"; do
+              case "$arg" in
+                -v | --version | --status | --stop)
+                  exec ${pkgs.gradle_9}/bin/gradle "$@"
+                  ;;
+              esac
+            done
+            runtime_dir="''${XDG_RUNTIME_DIR:-''${HOME:-/tmp}/.cache}"
+            mkdir -p "$runtime_dir"
+            lock="$runtime_dir/subtracks-gradle.lock"
+            if ! ${pkgs.util-linux}/bin/flock -n "$lock" ${pkgs.coreutils}/bin/true 2>/dev/null; then
+              echo "gradle: waiting for the build lock at $lock" >&2
+            fi
+            export GRADLE_OPTS="''${GRADLE_OPTS:-} -Dorg.gradle.workers.max=4"
+            exec ${pkgs.util-linux}/bin/flock "$lock" \
+              ${pkgs.coreutils}/bin/nice -n 10 ${pkgs.gradle_9}/bin/gradle "$@"
           '';
 
           basePackages = [