build: harden the gradle guard wrapper

- cap workers via GRADLE_OPTS instead of a CLI flag, so a caller passing
  --max-workers no longer collides and fails the build
- keep the lock under $XDG_RUNTIME_DIR (falling back to ~/.cache) rather
  than a world-writable /tmp path
- let --stop/--status/--version bypass the lock, and announce when a build
  is waiting for it
- drop the redundant GITHUB_ACTIONS check; the CI runners all set CI

flake.nix

@@ -41,11 +41,25 @@
           androidSdk = android.androidsdk;
 
           gradle_wrapper = pkgs.writeShellScriptBin "gradle" ''
-            if [ -n "''${CI:-}''${GITHUB_ACTIONS:-}" ]; then
+            if [ -n "''${CI:-}" ]; then
               exec ${pkgs.gradle_9}/bin/gradle "$@"
             fi
-            exec ${pkgs.util-linux}/bin/flock /tmp/subtracks-gradle.lock \
-              ${pkgs.coreutils}/bin/nice -n 10 ${pkgs.gradle_9}/bin/gradle --max-workers=4 "$@"
+            for arg in "$@"; do
+              case "$arg" in
+                -v | --version | --status | --stop)
+                  exec ${pkgs.gradle_9}/bin/gradle "$@"
+                  ;;
+              esac
+            done
+            runtime_dir="''${XDG_RUNTIME_DIR:-''${HOME:-/tmp}/.cache}"
+            mkdir -p "$runtime_dir"
+            lock="$runtime_dir/subtracks-gradle.lock"
+            if ! ${pkgs.util-linux}/bin/flock -n "$lock" ${pkgs.coreutils}/bin/true 2>/dev/null; then
+              echo "gradle: waiting for the build lock at $lock" >&2
+            fi
+            export GRADLE_OPTS="''${GRADLE_OPTS:-} -Dorg.gradle.workers.max=4"
+            exec ${pkgs.util-linux}/bin/flock "$lock" \
+              ${pkgs.coreutils}/bin/nice -n 10 ${pkgs.gradle_9}/bin/gradle "$@"
           '';
 
           basePackages = [