review fixes: integration.yml, basic example, surefire binding

[saurabhjain1592]

Summary

Deep-review pass over the QF-14 Java workstream (#147) caught several P0/P1 issues. All addressed in this single follow-up. CHANGELOG updated.

P0 — real bugs

1. Basic.java never closed AxonFlow — the class implements Closeable and shuts down OkHttp's dispatcher + connection pool in close(). Without try-with-resources, OkHttp's non-daemon threads keep the JVM alive ~60s after main returns; the workflow's timeout 90 mvn -q compile exec:java was burning most of its budget waiting for JVM exit. Wrapped the client lifecycle in try-with-resources.

2. userToken("demo-user") was rejected by the agent's JWT middleware. Real stacks validate user_token against a JWT secret; sending a literal non-JWT string returns 401. The catch-all catch (Exception e) then printed it as "expected on community without LLM", masking auth failure as success. Removed .userToken(...) from the ClientRequest builder — the SDK auto-populates user_token from clientId when omitted (AxonFlow.java:1304-1307).

3. Catch-all Exception swallowed everything in Step 2 — AuthenticationException, ConnectionException, even NullPointerException from a SDK regression. Narrowed to specific handlers: Authentication/Connection exit non-zero, PolicyViolation is a valid outcome, only RuntimeException not in those classes is treated as community-fail-open. The smoke is no longer the same kind of theater that the old continue-on-error: true was.

P1 — workflow / pom hygiene

4. -DskipUnitTests was an unbound property — running unit tests redundantly. pom.xml had no binding for skipUnitTests, so mvn verify -DskipUnitTests -B -U ran the 1211 surefire unit tests AND the 12 failsafe integration tests every PR. Bound to surefire's <skipTests> via the new <skipUnitTests>false</skipUnitTests> property. Verified locally: mvn verify -DskipUnitTests=true now runs only the 12 failsafe tests.

5. mvn install -DskipTests had no retry in the live-integration job, while every other Maven step in ci.yml has a 3-attempt retry loop for transient Central flakes. Single Central blip would kill the whole job. Added the same loop.

6. examples/basic/pom.xml version pin would silently drift on parent bump. It pinned <version>6.1.0</version>, and 6.1.0 is on Maven Central. When the parent bumps to 6.2.0, the example would keep resolving the OLD 6.1.0 from Central instead of the freshly-installed local SNAPSHOT — testing the wrong SDK against the new agent. Added a workflow step that rewrites the example pom's version to match mvn help:evaluate -Dexpression=project.version before running. Pin in the file is now informational; CI guarantees the dep matches.

7. Contract-integration was JDK 17 only; the unit-test matrix in ci.yml is 11/17/21. Matrixed contract-integration the same way to catch JDK-specific WireMock drift at PR time. Cheap (~3 minutes per JDK).

8. No artifact upload for triage. Added actions/upload-artifact@v4 for failsafe-reports (per JDK) on contract-integration failure, and docker-compose-logs on live-integration failure. Logs are now persisted to disk before teardown, captured even when triage happens hours later.

P1 — workflow correctness

9. Show docker logs on failure ran AFTER Stop community stack — compose down --volumes --remove-orphans destroys the containers; subsequent compose logs returns nothing. Reordered: capture/upload first (if: failure()), then teardown (if: always()).

P2 — hardening

• docker compose up -d --wait --wait-timeout 120 so compose's own healthcheck does part of the wait work.
• concurrency.group: integration-${{ github.ref }} so back-to-back pushes don't spawn parallel docker stacks.
• Cron moved from '0 6 * * 1' (Monday 06:00 UTC) to '0 6 * * 2' (Tuesday 06:00 UTC) — failures land in EU/IN working hours.
• Basic.java Step 3: added listConnectors() — free coverage of a 4th SDK surface, read-only, works on community.

CHANGELOG

User-facing entries under [Unreleased]:

• Added: examples/basic/ (was implicit before — example existed but wasn't in CHANGELOG)
• Fixed: mvn verify -DskipUnitTests=true now actually skips unit tests

CI / workflow plumbing intentionally NOT in CHANGELOG per feedback_changelog_no_internal_entries.md.

Self-review checklist

• Action versions pinned (@v4)
• permissions: contents: read scoped tight
• No new secret refs
• No continue-on-error: true
• No pom.xml version bump
• No AI attribution

Test plan

• mvn install -DskipTests -B clean (parent + example)
• mvn test -B (full unit suite): BUILD SUCCESS — 1211 tests, 0 fail
• mvn verify -DskipUnitTests=true -B: BUILD SUCCESS, only 12 failsafe tests run (was running 1211+12 redundantly before this PR)
• cd examples/basic && mvn -B compile clean
• Version-injection regex tested locally on a synthetic pom — rewrites 5.5.0 → parent version correctly across whitespace boundaries
• CI: contract-integration green on JDKs 11/17/21
• CI: live-integration green on push to main (basic example smoke + version sync + listConnectors)