[Operability] Prove and align repository runtime JDK with Java 25 build contract

[seonghobae]

Problem

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 has an internally inconsistent repository-runtime declaration:

• root Maven pom.xml requires <java.version>25</java.version> and compiles/tests with release 25;
• protected .replit declares modules = ["java", "java-17"] and then invokes mvn clean install / repository JARs;
• active runtime-supply-chain PR fix(supply-chain): retire unsafe Replit Zipkin bootstrap #169 retains the same explicit java-17 module declaration while fixing the separate Zipkin bootstrap/start-authority defects.

Hosted GitHub CI supplies Temurin 25 explicitly, so those green jobs do not prove the Replit/runtime declaration can satisfy the Java 25 build. Conversely, the source text alone does not prove which JDK Replit ultimately selects when both java and java-17 are present. This is an operability-evidence gap, not yet a claim that Replit definitely runs Java 17.

RCA

• Immediate cause: repository runtime metadata contains an explicit Java 17 declaration while the build contract requires Java 25.
• Technical root cause: Java-version consistency tests cover Maven/workflow configuration but do not bind repository runtime declarations or prove the effective runtime used by Replit/local launcher surfaces.
• Control failure: Java Version Check merely runs java -version; no contract compares its effective major version with the root Maven requirement before build/start, and hosted CI does not execute the Replit control plane.

Remediation options / feasibility

1. defer_until_trigger — preferred while fix(supply-chain): retire unsafe Replit Zipkin bootstrap #169 owns .replit: after fix(supply-chain): retire unsafe Replit Zipkin bootstrap #169 stabilizes/integrates, prove the actual supported Replit JDK selection mechanism from authoritative platform evidence or a real runtime probe, then align .replit to Java 25 and add a deterministic repository-runtime version contract.
2. execute_now after lease clears: make startup fail closed before Maven/service launch when effective java -version does not match the required major; this can avoid relying on a guessed Replit module name and provides observable acceptance evidence.
3. reject: inventing java-25, changing Nix/channel values without proving platform support, weakening the Maven Java 25 contract, or treating GitHub-hosted Temurin 25 as proof of the Replit runtime.

Acceptance

• actual repository runtime used by the supported Replit/local launch surface is proven to be Java 25 before build/service start;
• the check derives/compares against the canonical Maven Java requirement rather than duplicating an unbound magic number where practical;
• incompatible runtime fails before starting partial microservice topology;
• Linux/macOS/Windows hosted CI remains green for applicable source contracts;
• authoritative Operability/Architecture runtime guidance reflects the supported runtime and does not promote active-PR behavior to implemented_on_develop;
• no source write races fix(supply-chain): retire unsafe Replit Zipkin bootstrap #169 while its .replit branch is active.

This issue is independent of #165's reproducible artifact/container runtime inventory, but release evidence should eventually reconcile both Java build/runtime contracts.