ci: GitHub Actions workflow running check + assembleDebug

[ilmoniemi]

Summary

• Adds .github/workflows/ci.yml running ./gradlew check assembleDebug on every PR and push to main.
• Pinned to JDK 21 (Temurin) to match gradle/gradle-daemon-jvm.properties (toolchainVersion=21) — this resolves the spec's JDK 17 vs 21 open question deterministically. JDK 17 would force foojay to provision a 21 toolchain on every run.
• Concurrency cancels in-progress runs only for pull_request refs (cancel-in-progress: ${{ github.event_name == 'pull_request' }}) so merged commits on main always complete.
• Top-level permissions: contents: read for least-privilege.
• Uses pull_request (NOT pull_request_target) so fork PRs cannot access secrets.

Closes #85

Architecture compliance

Follows docs/specs/architecture/85-ci-workflow.md:

• Single job on ubuntu-latest
• actions/checkout@v4 → gradle/actions/wrapper-validation@v4 → actions/setup-java@v4 → gradle/actions/setup-gradle@v4 → ./gradlew check assembleDebug
• No matrix, no connectedAndroidTest, no artifact upload, no branch protection (all explicitly out of scope)

Only deviation from the spec: JDK 21 instead of the spec's default-to-17 recommendation. The spec flagged this as an open question; gradle/gradle-daemon-jvm.properties pins the daemon to Java 21, so JDK 21 on the runner is the correct choice.

Testing

• ./gradlew spotlessCheck — passes (the new YAML is covered by Spotless's misc formatter).
• ./gradlew check assembleDebug — passes locally (18s, BUILD SUCCESSFUL). One pre-existing Compose deprecation warning in DiscussionListScreen.kt:165 is unrelated to this ticket.
• The first CI run on this PR is itself the AC feat(data): seed FakeConversationRepository with 3 fake channels #5 validation — merge once it goes green.

Test plan

• CI workflow appears in the Actions tab on this PR
• Wrapper validation step passes
• check assembleDebug step passes
• No secrets are exposed (uses pull_request, not pull_request_target)
• Workflow file passes ./gradlew spotlessCheck (already verified locally)

🤖 Generated with Claude Code

[ilmoniemi]

Code Review: #85

Decision: PASS

Findings

• [NIT] PR description references docs/specs/architecture/85-ci-workflow.md, but the spec was actually added at docs/specs/architecture/85-ci-github-actions-check-assemble.md. Cosmetic — not blocking.

Summary

Small, surgical CI workflow that matches the spec faithfully. Notable strengths:

• JDK choice is correctly determined, not guessed. The spec flagged JDK 17 vs 21 as an open question with a default-to-17 recommendation. The developer resolved it deterministically by checking gradle/gradle-daemon-jvm.properties (toolchainVersion=21) and pinning the runner JDK to 21 — avoids forcing foojay to provision a second JDK on every run. Reasoning called out clearly in the PR body.
• Concurrency is correct. cancel-in-progress: ${{ github.event_name == 'pull_request' }} cancels superseded PR runs but lets main pushes complete, matching the spec.
• Security defaults are right. pull_request (not pull_request_target), top-level permissions: contents: read, and the dedicated gradle/actions/wrapper-validation@v4 step.
• Spotless-clean. YAML ends with a newline, no trailing whitespace — covered by format("misc") and verified by the green check step on CI itself.
• AC feat(data): seed FakeConversationRepository with 3 fake channels #5 satisfied. First CI run on this PR is green (build job passed in 4m17s).

All five acceptance criteria met, spec deviations are justified, no out-of-scope churn. Ship it.