Add CI: Gradle build workflow pinned to JDK 17

[dmccoystephenson]

Summary

• Adds .github/workflows/build.yml — the first CI on this fork. Until now no pull request here had any automated build signal.
• Pins JDK 17 (temurin) explicitly. This is not incidental: RPKit's Gradle 7.6 + Kotlin 1.7.22 + jvmTarget 17 combination only runs on a JDK in the 17–19 range. Measured on the dev device: JDK 21 fails with Unsupported class file major version 65, JDK 11 fails plugin resolution, and JDK 17 was not installed — so the project is currently unbuildable there by any local route.
• Compile and test are separate steps, so a red run is attributable — a failing Compile is a source/codegen break, a failing Test is a behaviour break.
• Follows the convention already established in Dans-Plugins/Medieval-Factions (actions/checkout@v4, actions/setup-java@v4 with temurin, chmod +x gradlew, permissions: contents: read).
• Adds Gradle dependency caching and a 60-minute timeout so a hung build fails in an hour instead of holding a runner for the default six.

Anchor verdict: RED — and the red is correct

The workflow ran on this PR and failed in 1m 7s at dependency resolution, before compiling any Kotlin:

> Could not find me.clip:placeholderapi:2.11.2.
> Could not find com.comphenix.protocol:ProtocolLib:5.0.0-SNAPSHOT.
    Required by: project :bukkit:rpk-characters-bukkit

This is pre-existing bit-rot, not a fault in this PR. Both artifacts were pinned when the project was last touched in 2024 and have since been removed from their repositories; nothing in this repo changed. Verified by direct probe — PlaceholderAPI's old repo URL 301s to repo.helpch.at/releases, where 2.11.2 returns 404, and ProtocolLib's maven-metadata.xml now lists only 5.3.0 and 5.4.0-SNAPSHOT. Filed with full detail and exact working coordinates as #3.

I deliberately did not arrange for this run to be green. Fixing the dependencies here would mean version bumps across 9 modules — a different change, on the do-not-auto-merge list, with unknown API drift behind it. Narrowing the workflow until it passed would cover 2 of 5 test modules and would misrepresent the project as building when it does not. A red anchor that accurately says "this project does not currently build" is worth more than a green one that was arranged to pass.

The workflow did exactly what it was added to do: it found a real blocker on its first run.

Scope of the anchor, stated honestly

./gradlew compileKotlin and ./gradlew test invoke those tasks across all 71 modules, but only 5 modules contain tests — rpk-notifications-bukkit, rpk-permissions-bukkit, rpk-players-bukkit, rpk-selection-bukkit, rpk-stats-bukkit (verified against the tree, not assumed). Once green, that means everything compiles and those five modules' tests pass — not that the other 66 have behavioural coverage. Treat a future green accordingly.

Test plan

• build.yml parses as valid YAML (yaml.safe_load)
• Steps and the pinned java-version: 17 / distribution: temurin confirmed by parsing the file, not by eye
• Verified jooq codegen uses DDLDatabase over checked-in SQL migration scripts, so no live database is needed on the runner
• Verified repo.properties is read only for publishing credentials and is not required to compile or test
• The workflow's first run on this PR reported a real verdict — fail, for the reason above
• Failure cause diagnosed to root and filed separately (Build fails: PlaceholderAPI 2.11.2 and ProtocolLib 5.0.0-SNAPSHOT no longer resolve #3) rather than worked around

Do-not-auto-merge

This PR modifies .github/workflows/*, which is on the do-not-auto-merge list. It is left open for human review by design — not because anything failed.

Suggested next step: merge to establish the anchor, then take #3 to get it green.

Closes #1

[dmccoystephenson]

Self-review rubric:

• Scope: PASS — git diff --name-only origin/main...HEAD returns exactly one path, .github/workflows/build.yml (41 insertions, 0 deletions). No incidental edits.
• Sibling structure: PASS — matches the convention in Dans-Plugins/Medieval-Factions/.github/workflows/build.yml: actions/checkout@v4, actions/setup-java@v4 with temurin/17, chmod +x gradlew, permissions: contents: read. This is the first file in a new directory, so the siblings compared against are cross-repo.
• Docs: PASS — the scope claim in the PR body was re-verified against the tree, not asserted from memory: find . -path '*/src/test/*' -name '*.kt' resolves to exactly 5 modules (rpk-notifications-bukkit, rpk-permissions-bukkit, rpk-players-bukkit, rpk-selection-bukkit, rpk-stats-bukkit) out of 71 in settings.gradle. The stated JDK matches the file.
• Issue resolution: PASS — every acceptance criterion on Add CI: Gradle build workflow pinned to JDK 17 #1 is met: the workflow exists, parses as valid YAML, pins JDK 17, triggers on pull requests, produced a real verdict on its first run, and the PR body states its true coverage. A red verdict is still a verdict; Add CI: Gradle build workflow pinned to JDK 17 #1 asked for an anchor, not a green one.
• No credential churn: PASS — repo.properties is not in the diff.
• CI: FAIL — the anchor is red on this PR head. See below; this is the one item that needs a human decision rather than a fix here.
• Tests-new / Tests-fix / License header / Permission declared / lib-impl pair / Result type / Service resolution / Main-thread I/O / Messages externalized / Fidelity to upstream: not applicable — this PR adds no Kotlin, no commands, no permissions, and is fork-native rather than mirrored from upstream.

On the CI FAIL. The workflow ran, reached dependency resolution, and failed in 1m 7s with:

> Could not find me.clip:placeholderapi:2.11.2.
> Could not find com.comphenix.protocol:ProtocolLib:5.0.0-SNAPSHOT.
    Required by: project :bukkit:rpk-characters-bukkit

That failure is pre-existing bit-rot, not something this PR introduced — both artifacts were pinned in 2024 and have since been removed from their repositories. I verified the specifics by probing the repos directly (PlaceholderAPI's old URL 301s to repo.helpch.at/releases, where 2.11.2 returns 404; ProtocolLib's metadata now lists only 5.3.0 and 5.4.0-SNAPSHOT) and filed the details as #3.

I deliberately did not make this run green. Two options were available and both were rejected:

1. Fix the dependencies here. That would mean version bumps across 9 modules' build.gradle files — a materially different change from "add CI", on the do-not-auto-merge list, with unknown API-drift work hiding behind it. Add CI: Gradle build workflow pinned to JDK 17 #1 explicitly scoped it out.
2. Narrow the workflow until it passes. PlaceholderAPI is used by 3 of the 5 test-bearing modules, so a passing subset would cover 2 modules and would misrepresent the project as building when it does not.

A red anchor that accurately reports "this project does not currently build" is worth more than a green one that was arranged to pass. The workflow did precisely the job it was added to do — it found a real blocker on its first run.

Recommendation: merge this to establish the anchor, then take #3 as the next cycle to get it green.