[BUILD]: Upgrade package ws from 8.20.1 to 8.21.1 - #894

…ugins

First slice of #804. Two convention plugins land in build-logic/convention,
and three representative modules migrate to prove the shapes.

sk.ainet.multiplatform absorbs the Kotlin Multiplatform boilerplate that
every library module copies today: the target list, the android { } body,
explicitApi(), kotlin-test in commonTest, and the Karma hardening that was
duplicated as 23 byte-identical karma.config.d files. The single shared copy
now lives at gradle/karma.config.d/ and is wired in via
KotlinKarma.useConfigDirectory.

Which platforms a module builds comes from the skainet.targets Gradle
property rather than the skainet { } DSL. Targets must exist before the
module's own kotlin { } block runs -- the source-set convention accessors
create source sets on access, and KGP then refuses to attach a compilation
to one that already exists ("The compilation 'main' cannot be created after
the source set 'jvmMain'"). A DSL block is evaluated too late for that;
Gradle properties are readable while the plugin is applied. Everything
non-structural stays in skainet { }.

sk.ainet.npm-pins closes the Gradle/JS half of #847 and supersedes #894.
PR #894 tried to bump ws 8.20.1 -> 8.21.1 (GHSA-96hv-2xvq-fx4p) by editing
kotlin-js-store/wasm/yarn.lock, a generated file; kotlinWasmUpgradeYarnLock
put it straight back, leaving a zero-line diff. Declaring npm("ws", ...) in
a source set would not have worked either, since ws is transitive. The pin
is now one npm-ws line in libs.versions.toml, turned into a Yarn resolutions
entry in both the JS and Wasm root package.json files; verifyNpmPins reads
the committed lockfiles back and fails on drift.

Verified: ./gradlew :module:tasks --all is byte-identical before and after
for all three pilots; apiCheck passes with no new dumps; publishToMavenLocal
plus validate-published-poms.sh reports all 1131 POMs unchanged; both
lockfiles regenerate onto ws 8.21.1; verifyNpmPins passes and fails as
expected when a lockfile is tampered with; jsTest/wasmJsTest still receive
the Karma timeouts; ./gradlew build is green and reuses the config cache.

Progresses #804
Closes #847
Supersedes #894