fix: preserve exact Java builds in report and site validation

[tappe9]

Summary

Closes #72.

• Reuse the existing exact Java release-build contract only for java-spring-boot/java: three or four ASCII numeric components followed by a mandatory numeric build. Preserve the complete recorded value, including 25.0.4.1+1.
• Keep every other required/additional field on the existing numeric triplet contract. Align ASCII and full-string matching between Python and JavaScript, rejecting Unicode digits and trailing controls consistently.
• Exercise 156 shared language-neutral valid/invalid cases in both validators, plus extraction-to-report and exact escaped rendering with an isolated synthetic Java cohort that the production registry rejects.
• Document the bounded contract. No production cohort, profile, API, dependency pin, result/history or generated registry changes.

Verification

Before changing production code, the new tests reproduced the pinned Java build rejection in both Python and JavaScript. After the fix:

• Version conformance: 3 Python tests pass; shared JavaScript cases and exact rendering pass.
• Node site/dashboard: 27 tests pass.
• Registry generated-output check, README generated-output check, Ruff lint/format and git diff --check pass.
• Contract unit suite: 38 tests pass; workflow tests: 21 pass.
• Independent read-only review: no findings; independently passed registry (12), publication (14), site (16), and conformance (3) tests.

Exact-head CI

CI run 36670787154 completed successfully for head 4aa7d55f55688d99e76808e63ffe26344b97ab61: all 13 jobs passed (plan, shared, all nine implementation acceptance/contract jobs, non-publishing smoke, and required aggregate). This includes the site/browser, workflow/actionlint, report/publication, Python 3.10 compatibility, DB, and Axum diagnostic gates unavailable in the local environment. Independent re-review of the final committed SHA found no issues; the working tree is clean.

Local environment limits (covered by successful CI)

• Full make test-benchmark and optimized Python suite each ran 196 tests with one pre-existing host-tool failure: test_go_echo_module_and_unit_contract_are_clean; this machine's /usr/bin/go is not the Go compiler (Go: Unknown option: mod). The same failure was verified before the change.
• make test/Compose gates are blocked by absent Docker; production acceptance/smoke were not run locally.
• make test-site Python tests and Node non-browser tests pass, but Chromium cannot open its local singleton socket in this environment (Operation not permitted), including the permitted elevated retry.
• Actionlint is unavailable locally; it passed in exact-head CI.

This draft does not authorize cohort admission, an official benchmark, merge, or deployment.