[b-re-w]

Closes #18

Adds extended-native-image.yml (no paths filter): window config check (upcall table, no runtime reflection, K/N sources), plugin DSL additive check, a JVM hello cell, and a Package cell per platform on macOS arm64 and Linux x64. Each Package cell pins core-extended, caches skiko's static archive, publishes the window modules and the plugin to mavenLocal, then:

• builds and starts extended/native-image/hello-awtfree-link, a plain AwtFree main that opens one window through the window module, so appkit_window.m or x11_window.c and the upcall table must compile and link into the image;
• builds the existing hello as a marked placeholder until hello-awtfree lands (its steps switch on when the sample exists);
• keeps the compose-rust/pythonx checks as separate, clearly named steps.
  The K/N packaging cell has a marked slot.

Not the gate: the inherited upstream workflows (Setup Prerequisites fails at the Android SDK) and the "Test Gradle plugin" matrix. The red entries on this PR right now are runs cancelled by the owner's CI hold, not failures.

Known, not caused by this PR: the existing AWT extended/native-image/hello (windowing = Awt) fails to link on macOS arm64 with NIK 25.0.4.1: Undefined symbols: _Java_java_awt_Cursor_finalizeImpl, referenced from ___data in native-image-hello.o. It is the Awt path, not an AwtFree leak: the macOS Awt link list names libawt_lwawt.a, libosxui.a and libjawt.a and none of them defines java.awt.Cursor's native, which lives in libawt. The code that builds that list is unchanged by the AwtFree work. The AwtFree gate here is hello-awtfree-link, which has no AWT classes; any java.awt reachability in hello-awtfree is #42's to remove.