[CDC maintainability] Remove deprecated Jackson tree-iteration API after mapper lane stabilizes

[seonghobae]

Gap

Exact hosted CI for the protected mightyETL line currently emits a Java compiler deprecation warning for cdc-service, and protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 contains DebeziumChangeRecordMapper.toMap(...) implemented with Jackson tree iteration via JsonNode.fields(). This is a future-compatibility/maintainability boundary: deprecated library APIs should not remain silently embedded in a commercial integration layer, especially while the repository is already converging on an explicit Jackson baseline.

Status: known_gap / defer_until_trigger for source mutation. Active Draft PR #209 currently owns DebeziumChangeRecordMapper.java for an independent malformed-key data-integrity repair at exact head 40e47f69bb76de7e68073e0d1136f1b94db31f3d; do not race that writer or broaden #209 merely to silence a compiler warning.

RCA / falsifiable next probe

• Symptom: Maven compilation reports that DebeziumChangeRecordMapper.java uses or overrides a deprecated API.
• Likely boundary: Jackson tree-field iteration in the mapper, based on current protected source inspection.
• Control gap: ordinary CI reports the warning but does not fail or print -Xlint:deprecation detail, so the exact deprecated member must be proven before changing production source.
• First falsifiable probe after fix(cdc): preserve valid value when Debezium key JSON is malformed #209 clears: compile the accepted current mapper with deprecation diagnostics enabled and record the exact member/signature and owning Jackson version. If the warning resolves to a different call site, update scope rather than making a speculative replacement.

Distinct remedies / feasibility

1. execute_after_trigger — preferred: after fix(cdc): preserve valid value when Debezium key JSON is malformed #209 stabilizes/integrates, add a fail-first source/compile contract that identifies the deprecated call, replace only that call with the supported Jackson API for the accepted dependency line, and prove semantic equivalence for object-field order, nulls, numbers, booleans, text and nested values.
2. defer: if the accepted Jackson baseline changes first, re-run the diagnostic against that exact dependency graph and use the API supported by that version.
3. reject: suppress the compiler warning, globally disable deprecation diagnostics, or guess at a replacement while fix(cdc): preserve valid value when Debezium key JSON is malformed #209 owns the file. Those actions do not remove the compatibility cause and would race active work.

Acceptance

• exact accepted dependency graph and exact deprecated member are recorded before production mutation;
• real mapper tests prove the replacement preserves canonical event semantics, including nested-value serialization and deterministic field traversal behavior where relied upon;
• no raw key/value diagnostics are added;
• touched public API/Javadoc remains beginner-readable;
• full CDC/reactor tests plus current dependency/SBOM/SAST/security evidence pass on the unchanged candidate head;
• applicable owned-production statement/branch coverage is non-vacuous and accepted;
• canonical documentation is updated only if the replacement changes a public compatibility contract; otherwise this remains an implementation-maintenance item.

Relationship: #209 owns current mapper behavior; #160 owns the shared Jackson dependency baseline; #196 owns dependency-resolution/scanner completeness; #205 owns repository-wide coverage scope.