chore: update template tooling and remove image publishing #40

Problem

Four independent Renovate PRs update the same small Java training template.
The container build uses an older Gradle image than the wrapper.
The optional Just path selects Gradle 8.14.1.
Every main push also builds and publishes runtime and toolchain images for two architectures, although local commands use the official Gradle image.
The README repeats development details and stale container versions.

Intended behavior

Combine PRs #34, #36, #38, and #39 into one tested tooling update.
Use Checkstyle 14.3.0 and mise-action 5.2.1 with verified immutable action references.
Use the same mise Corretto Java 21 selection in local commands and all CI jobs.
Pin the tested development tools and invoke the pinned YAML linters through mise.
Use the official Gradle 9.8.1 Java 21 image and its verified digest in both container entry points, matching the wrapper version.
Remove the automatic image publication workflow and keep local Docker builds available.
Run the full quality and coverage suite on Linux and native compile/test checks on Windows and macOS.
Compile the solution for Java 8, 11, 17, and 21 without repeating the full analysis and coverage suite for each target.
Shorten the README and link a development guide for challenge setup, Java targets, and local commands.
Preserve the existing Java implementation, quality gates, coverage thresholds, and Apache-2.0 license.
Remove stale Gradle version comments.
Pin the existing runtime and toolchain base images to their current registry digests.
Make the existing push check inspect all tracked files on new branches.

Scope

• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/docker-publish.yml
• Dockerfile
• Dockerfile.toolchain
• gradle/libs.versions.toml
• justfile
• mise.toml
• lefthook.yml
• README.md
• docs/development.md

Acceptance criteria

The combined dependency update passes the existing build, lint, tests, and coverage gates.
Java 8, 11, 17, and 21 target checks remain in CI.
Container and native builds select the committed wrapper's Gradle version and Java 21.
No image publication starts on main pushes, tags, or manual dispatch.
Close superseded Renovate PRs only after reading back the tested changes on main.