build: add Gradle dependency locking

[soloturn]

Adds Gradle dependency locking only — deliberately no versioning changes (no nebula.release, -SNAPSHOT scheme untouched). That's a separate, follow-up concern.

• dependencyLocking { lockAllConfigurations() } on every subproject, each with its own gradle.lockfile. No buildscript-classpath lockfile needed here — root has no buildscript {} block.
• Same -PnoLock escape hatch used elsewhere in the org: passing it skips dependencyLocking{} entirely for that build, letting every range resolve fresh — useful for trying an update locally before committing to it via --write-locks.

Caveat worth flagging: with dependencies still pinned to literal -SNAPSHOT coordinates, locking freezes the version string, not necessarily the underlying artifact bytes — Gradle still treats a -SNAPSHOT coordinate as a changing module. Full reproducibility follows once versions move off SNAPSHOT.

Test plan:

• ./gradlew build -x test succeeds with locking active (JDK 21 — the 8.2.1 wrapper here can't run on JDK 26)
• Lockfiles generated via ./gradlew dependencies --write-locks per subproject

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6dc6d0f1-ffa0-4ab9-b81a-5a183f4db81e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[BenjaminAmos]

Can you please re-create this change against the preview/v4.x-SNAPSHOT branch?

[soloturn]

@BenjaminAmos done - rebased onto preview/v4.x-SNAPSHOT, base retargeted, lockfiles regenerated for that branch's module set (single nui-gestalt, gestalt 8.0.0-SNAPSHOT). ./gradlew build -x test green.