ci: restore lean Java CI gate to pair with go-parity workflow

The earlier "remove Java build from pipeline" iteration deleted
ci-java.yml outright, leaving go-parity.yml as the only thing exercising
the Java side on every PR — which means a Java compile break would only
surface inside the parity test rather than as its own failure signal.

This restores ci-java.yml as a lean gate:
- Triggers only on src/**, pom.xml, or this workflow path-filtered changes
  (Go-only PRs do not run the Java side).
- `mvn -ntp -Dfrontend.skip=true verify` — compile + unit tests only,
  no jacoco coverage, no spotbugs, no OWASP. Those heavier checks stay
  under release-java.yml workflow_dispatch.
- Uploads surefire-reports on always() so a regression artifact is
  recoverable.

This is the partner gate the parity workflow assumed existed. Disappears
in Phase 6 cutover with the rest of the Java tree.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

.github/workflows/ci-java.yml

@@ -0,0 +1,55 @@
+name: Java CI
+
+# Lean Java CI — fast compile + unit-test gate on the Java reference side.
+# Pairs with go-parity.yml: this workflow proves the Java jar still builds
+# on every PR; go-parity.yml then uses the same build to diff against the
+# Go port.
+#
+# Heavier checks (jacoco coverage, SpotBugs, OWASP dependency-check) live
+# under workflow_dispatch via release-java.yml — they're not in the per-PR
+# loop because they slow the Go port's PRs without adding signal.
+#
+# Disappears in Phase 6 cutover along with the rest of the Java tree.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'pom.xml'
+      - '.github/workflows/ci-java.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'pom.xml'
+      - '.github/workflows/ci-java.yml'
+
+permissions: read-all
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v4.7.1
+        with:
+          distribution: 'temurin'
+          java-version: '25'
+          cache: 'maven'
+      - name: Compile + unit tests (skip frontend)
+        # -Dfrontend.skip=true so the npm step doesn't run — CI image
+        # doesn't carry node 20 by default and the frontend is owned by
+        # a separate workflow. -B (batch) + -ntp (no transfer progress)
+        # for quiet logs.
+        run: mvn -B -ntp -Dfrontend.skip=true verify
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.2
+        if: always()
+        with:
+          name: java-test-results
+          path: target/surefire-reports/