fix(java_opts): handle multiple \$JAVA_OPTS in one opts file; fix %% in fmt.Sprintf

Two bugs fixed:

1. The if-guard (single replacement) became a bounded for-loop so opts files
   with $JAVA_OPTS more than once are handled correctly. Scenario: a user sets
   JBP_CONFIG_JAVA_OPTS: '{java_opts: "$JAVA_OPTS -Xmx512m", from_environment: true}'
   which produces "$JAVA_OPTS -Xmx512m $JAVA_OPTS" in the opts file — two placeholders.

2. The _before cut used %% in the Go fmt.Sprintf template, which emits a
   single % in the generated bash (shortest-suffix removal). With two
   placeholders, % cuts from the wrong side, leaving placeholders in place.
   Changed to %%%% in Go source → %% in bash (longest-suffix removal) so
   each for-loop iteration always removes from the first occurrence.

Test added (TDD): "replaces all occurrences of $JAVA_OPTS when opts file
contains it twice" — was red before both fixes, green after.

Also: scripts/unit.sh: use ${BASH_VERSION} builtin instead of bash --version
pipe (Copilot review comment 2).

Author: stokpop

scripts/unit.sh

@@ -14,7 +14,7 @@ function main() {
   local src
   src="$(find "${ROOTDIR}/src" -mindepth 1 -maxdepth 1 -type d )"
 
-  echo "bash: $(bash --version | head -1)"
+  echo "bash: ${BASH_VERSION}"
 
   util::tools::ginkgo::install --directory "${ROOTDIR}/.bin"
   util::tools::buildpack-packager::install --directory "${ROOTDIR}/.bin"

src/java/frameworks/java_opts_writer.go

@@ -196,14 +196,19 @@ if [ -d "$DEPS_DIR/%s/java_opts" ]; then
 
             # Restore USER_JAVA_OPTS via string-split, not ${//}: bash 4.x and 5.x
             # treat '\\' in replacement strings differently, corrupting backslashes.
-            # %% / # are pure string ops — no special-char interpretation, any bash.
-            # Guard required: without placeholder present, %% and # return the full
-            # string, so omitting the guard duplicates opts_content.
-            if [[ "$opts_content" == *"$_user_java_opts_placeholder"* ]]; then
-                _before="${opts_content%%"$_user_java_opts_placeholder"*}"
+            # %%%% / # are pure string ops — no special-char interpretation, any bash.
+            # Pre-count occurrences so the loop is bounded even if USER_JAVA_OPTS
+            # itself contained the placeholder string (infinite-loop defence).
+            # Counting uses empty replacement — no backslash in replacement, safe.
+            # Handles multiple occurrences (e.g. user config "$JAVA_OPTS -Xmx512m"
+            # with from_environment:true produces "$JAVA_OPTS -Xmx512m $JAVA_OPTS").
+            _stripped="${opts_content//"$_user_java_opts_placeholder"/}"
+            _placeholder_count=$(( (${#opts_content} - ${#_stripped}) / ${#_user_java_opts_placeholder} ))
+            for (( _i=0; _i<_placeholder_count; _i++ )); do
+                _before="${opts_content%%%%"$_user_java_opts_placeholder"*}"
                 _after="${opts_content#*"$_user_java_opts_placeholder"}"
                 opts_content="${_before}${USER_JAVA_OPTS}${_after}"
-            fi
+            done
             
             if [ -n "$opts_content" ]; then
                 JAVA_OPTS="$JAVA_OPTS $opts_content"

src/java/frameworks/java_opts_writer_test.go

@@ -370,6 +370,15 @@ var _ = Describe("Java Opts Writer", func() {
 			Expect(output).To(ContainSubstring(`-Dpath=C:\\double`))
 		})
 
+		It("replaces all occurrences of $JAVA_OPTS when opts file contains it twice", func() {
+			// Scenario: JBP_CONFIG_JAVA_OPTS: '{java_opts: "$JAVA_OPTS -Xmx512m", from_environment: true}'
+			// produces opts file: "$JAVA_OPTS -Xmx512m $JAVA_OPTS" — two placeholders
+			output, err := runScript(`-Dfoo=bar`, "$JAVA_OPTS -Xmx512m $JAVA_OPTS")
+			Expect(err).NotTo(HaveOccurred(), "script failed with output: %s", output)
+			Expect(strings.Count(output, "-Dfoo=bar")).To(Equal(2))
+			Expect(output).NotTo(ContainSubstring("__JAVA_OPTS_BUILDPACK_PLACEHOLDER__"))
+		})
+
 		// Full invocation cycle tests for issue #1301:
 		// Verify that javaexec tokenizes $JAVA_OPTS without a shell, so glob chars,
 		// pipes, and shell metacharacters are never expanded or executed.