Write SpotBugs reports and publish static analysis on pull requests (#110) (#114)

* build: write SpotBugs XML and HTML reports (#110)

The SpotBugs tasks had no report configured, so findings went to stdout
only and, with ignoreFailures, scrolled past unread. Every SpotBugsTask
now writes XML (for CI to count) and HTML (for people) to the plugin's
default location, <module>/build/reports/spotbugs/main.{xml,html}.
ignoreFailures stays; the build still passes with findings present.

Fixes #110

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* ci: run PMD and SpotBugs on pull requests and publish the reports (#110)

The compile job runs pmdMain and spotbugsMain after compiling (report
only: both tools have ignoreFailures, a crash of a tool still fails),
counts <violation> and <BugInstance> elements per module from the report
XML into the job summary, and uploads */build/reports/pmd and
*/build/reports/spotbugs as the static-analysis artifact for 14 days.
A missing report prints "no report" without failing the step.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* docs: name the PMD and SpotBugs report files and the CI artifact (#110)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

build.gradle.kts

@@ -41,6 +41,16 @@ subprojects {
         ignoreFailures.set(true)
     }
 
+    // Without a configured report SpotBugs prints its findings to stdout only and leaves
+    // no file behind; with ignoreFailures they then scroll past unread. AGENTS.md asks for
+    // the findings visible in a build to be reported, which needs something to read them
+    // from: XML for CI to count, HTML for people. Default location, which the plugin names
+    // after the source set: <module>/build/reports/spotbugs/main.{xml,html} (#110).
+    tasks.withType<com.github.spotbugs.snom.SpotBugsTask>().configureEach {
+        reports.create("xml") { required.set(true) }
+        reports.create("html") { required.set(true) }
+    }
+
     /*
      * Coverage is a report, not a gate: there is no jacocoTestCoverageVerification and no
      * minimum percentage. A threshold set at today's number would trip on the next unrelated