fix: resolve CodeQL job OOM and Default Setup conflict

- gradle.properties: add kotlin.daemon.jvmargs=-Xmx2048m to prevent
  Kotlin compiler OOM (the root cause of the failing run 76567513542)
- codeql.yml: add step to disable GitHub Default Setup via gh api
  before CodeQL init, resolving the SARIF upload conflict caused by
  having both Default Setup and advanced setup active simultaneously

Author: Copilot

.github/workflows/codeql.yml

@@ -31,6 +31,21 @@ jobs:
           distribution: 'temurin'
           cache: gradle
 
+      - name: 🔒 Disable Default Code Scanning Setup
+        # Advanced setup (this workflow) conflicts with Default Setup when both are active.
+        # docs.github.com/en/rest/code-scanning/code-scanning#update-a-code-scanning-default-setup-configuration
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if api_output=$(gh api repos/${{ github.repository }}/code-scanning/default-setup \
+              --method PATCH \
+              -f state=not-configured 2>&1); then
+            echo "Default setup disabled successfully."
+          else
+            echo "Warning: could not disable default setup via API (may already be disabled or token may lack permissions): $api_output"
+            echo "If this issue persists, manually disable it at: Settings > Code security > CodeQL analysis > Default setup."
+          fi
+
       - name: 🔎 Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:

gradle.properties

@@ -7,6 +7,7 @@
 # Specifies the JVM arguments used for the daemon process.
 # The setting is particularly useful for tweaking memory settings.
 org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+kotlin.daemon.jvmargs=-Xmx2048m
 # When configured, Gradle will run in incubating parallel mode.
 # This option should only be used with decoupled projects. More details, visit
 # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects