[jmacauley]

Summary

Enable Java 17-compatible artifacts and build/runtime verification on Java 17, 21, 25, and 27. The existing Java 21 compilation target prevented Java 17 consumers from loading the library; production and test sources now compile with --release 17, Maven permits JDK 17+, and the library uses the completed Java 17-compatible common-lib:2.0.1 release. Other Java versions remain unverified.

• Add a GitHub Actions source-build/Javadoc matrix and a separate runtime matrix that tests the same Java 17-built JAR and compiled tests without recompilation.
• Add multi-release-aware dependency/artifact bytecode validation, safe artifact bundle/restore handling, strict handwritten production/test Javadoc validation, and six helper regressions.
• Pin action revisions and Maven 3.10.0; verify the Maven download checksum, limit workflow permissions, and fail explicitly on private-package resolution problems. Do not use pull_request_target or share package credentials with forks.
• Update README, AGENTS, supplemental context, and the Makefile comment. Keep the default development container on JDK 21. No production Java API or schema changes.

Validation

Local verification used Maven 3.10.0 and installed Homebrew JDKs on macOS:

JDK	Clean source build	Same Java 17 artifact runtime	Strict main/test Javadoc	Bytecode checks
17	84 tests passed	84 tests passed	Passed	Passed
21	84 tests passed	84 tests passed	Passed	Passed
25	84 tests passed	84 tests passed	Passed	Passed
27	84 tests passed	84 tests passed	Passed	Passed

Runtime verification restored the Java 17 bundle into isolated temporary workspaces, invoked surefire:test directly, and confirmed compiled-file checksums stayed unchanged. No separate integration tests are present.

Also passed: 28 focused Java 17 tests; six Python helper regressions; actual Maven setup download/checksum/extraction/version check; Bash syntax; workflow/POM parsing; referenced-path checks; git diff --check.

Remaining CI prerequisites

The new Linux/Temurin hosted matrix and fresh-registry package access have not run yet. Local builds used the existing Maven cache and emitted a nonblocking GitHub Packages prefix-metadata HTTP 401. The workflow uses GITHUB_TOKEN by default; cross-repository package reads may require repository secrets PACKAGES_USERNAME and PACKAGES_READ_TOKEN. Missing access fails verification explicitly. No credentials were added and no artifacts were published.