feat: add bounded JVM warm-up diagnostic

[tappe9]

Summary

Prepares the approved, non-publishing investigation for #73; this PR does not close the issue or admit Java to an official cohort.

• Fix Java / Spring Boot, Node / Fastify and Go / Gin to three rotated clean-start rounds on one host, with /json → /db/42 → /cpu, five-second warm-up and four consecutive 30-second windows
• Record every window, CPU/memory/timing, exact source/image/version metadata, failed/not-started attempts and checksums; fail closed with scoped cleanup and no retries
• Add one manual-only read-only Actions workflow: 120-minute job cap, 104-minute harness timeout plus 120-second teardown grace and reserved upload time
• Predeclare conservative provisional interpretation and explicit JIT/GC/instrumentation limits in docs/JVM-DIAGNOSTIC.md
• Preserve official workflows, frozen profile/cohorts, applications, pins and published results

Verification

• TDD red → green for harness, environment and workflow
• 26 JVM-specific tests pass normally and under python -O
• 23 workflow tests, 38 shared contract tests, 27 Node presentation tests pass
• Registry, README generation check, Ruff format/check and git diff --check pass
• Independent review completed; timeout grace finding fixed and re-reviewed
• Full local benchmark suite: 222 tests, one pre-existing environment failure (test_go_echo_module_and_unit_contract_are_clean: installed go rejects mod); real toolchain CI remains required
• Local Compose/full acceptance unavailable because Docker is absent; browser presentation test blocked by the container's Chrome crashpad configuration. Python site/history/Pages tests pass. Exact-head CI will cover these gates before merge

Execution boundary

The owner approved preparing, reviewing and merging this workflow, followed by exactly one bounded diagnostic run. No diagnostic load has been run for this PR. Dispatch only after CI/review and merge, then inspect all original evidence before proposing the next decision. A failed/inconclusive run must not be automatically repeated. Artifact access follows normal repository visibility, with configured 90-day retention. No official benchmark, cohort/profile change or official publication is authorized by this PR.