Binder: refuse withGIL on JVM virtual threads (#161) - #303

Closes #161

• Cause: withGIL keeps its nesting depth in the virtual thread's ThreadLocal, but PyGILState_Ensure binds the thread state to the OS carrier thread.
• Fix (option A, approved): on desktop, the outermost withGIL on a virtual thread throws IllegalStateException before PyGILState_Ensure. The message gives the reason and says to use platform threads. checkGILThread is an expect function. Its desktop actual guards the JDK 21 Thread.isVirtual call behind a Runtime.version() check, and the Android, native and wasm actuals are no-ops. No public API change.
• SPEC T-1a records this. Option B (pinning) needs withGIL's block to become crossinline, a public API change that is pending a user decision.
• Test: VirtualThreadGILTest. Removing only the checkGILThread() call makes it fail. After it, the GIL is not leaked and a platform-thread withGIL still works.
• Full desktopTest passes (629). compileKotlinAndroidNativeArm64, compileKotlinIosSimulatorArm64, compileKotlinWasmJs and compileDebugKotlinAndroid pass. The ksp app fixture desktopTest passes.