[Data Integrity] Recursively snapshot structured ChangeRecord values

[seonghobae]

Buyer-visible integrity gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 makes etl-service ChangeRecord top-level before / after / pk maps unmodifiable and snapshots those map objects, but nested JSON-shaped Map and List values remain aliased to caller-owned mutable objects. A connector or adapter can therefore observe a different normalized record after construction if an upstream caller mutates a nested object/array, contradicting the class-level promise that callers cannot mutate a record after it enters the connector pipeline.

This matters for plugin/connector determinism, equality/hash stability, replay/audit reasoning, and cross-service handoff integrity. The live Debezium/ObjectMapper path represents nested JSON objects/arrays as ordinary Java maps/lists, so this is a real supported data shape rather than an exotic arbitrary-object case.

Scope

Keep the repair bounded to etl-service ChangeRecord and focused tests. Do not modify active CDC CanonicalChangeRecord PR #222, connector registry work, provider implementations, database migrations, or serialization contracts.

Test-first acceptance

1. Add a failing regression first using nested mutable LinkedHashMap and ArrayList values inside after (and, where useful, before/pk).
2. Prove both mutation paths fail closed from the caller perspective:
   • mutating the original nested containers after construction cannot change the record;
   • nested containers reachable through getters are unmodifiable.
3. Preserve nested null values and list elements.
4. Preserve current scalar/object identity semantics for non-container values; do not pretend arbitrary mutable third-party objects can be cloned safely.
5. Implement the narrowest recursive snapshot for JSON-shaped Map<?, ?> and List<?> containers, with beginner-readable Javadocs explaining the boundary.
6. Run focused and full applicable tests and keep the PR Draft until shared literal-source, scanner-completeness, non-vacuous coverage, and independent-review gates are satisfied.

Non-goals

• no serialization redesign;
• no arbitrary reflection/Java-serialization deep clone;
• no mutation of active fix(cdc): snapshot canonical change record maps #222;
• no gate weakening or cross-repository change.

[seonghobae]

Integrated on protected develop by PR #269. Merge commit 106add38465937f6eb4e4accc185fd30aab4446f changes only ChangeRecord.java and ChangeRecordTest.java, implements recursive immutable snapshots for JSON-shaped Map/List containers, preserves nested nulls and non-container identity, rejects cycles deterministically, and includes focused regression coverage. Closing as completed; future regressions should open a new issue against the then-current protected head.