Native build issues (finos#2619)

* fix(calm-hub): pin MCP server to 1.12.1 to restore native image builds

quarkus-mcp-server-bom:3.34.7 (added in PR finos#2608) resolves all MCP
artifacts to 1.10.5, a downgrade from the previously pinned 1.12.0.
Version 1.10.5 predates the native-image fix added in 1.12.0
(quarkiverse/quarkus-mcp-server#684/finos#685: fix elicitation and sampling
in native image), causing both native CI workflows to fail at Quarkus
augmentation.

Add explicit dependencyManagement overrides in calm-hub/pom.xml pinning
all five MCP runtime and deployment artifacts to 1.12.1, overriding the
1.10.5 resolved by the platform BOM.

Verified: both build-native-image.sh --no-docker and
build-readonly-native-image.sh --no-docker produce BUILD SUCCESS with a
220MB native binary.

* fix(calm-hub): remove Netty version override to fix native image on x86_64

Netty 4.1.135.Final (overridden in PR finos#2608) registers
io.netty.handler.codec.compression.BrotliDecoder for link-at-build-time
in netty-codec's native-image config. On linux/x86_64 (CI), brotli4j
native libs are not on the classpath, causing a fatal unresolved method
error during native image analysis.

Quarkus 3.34.7 already manages Netty at 4.1.132.Final, which patches
CVE-2025-58057, CVE-2026-33870, and CVE-2026-33871 (all affecting
<=4.1.131.Final). The 4.1.135.Final override is unnecessary and breaks
native image compilation on x86_64 CI runners.

* fix(calm-hub): remove duplicated MCP dependencyManagement block

The five io.quarkiverse.mcp version overrides (and their comment) were
accidentally duplicated in the dependencyManagement section. Remove the
second identical copy, leaving one set pinning all MCP artifacts to 1.12.1.

Author: jpgough-ms

calm-hub/pom.xml

@@ -20,20 +20,15 @@
         <surefire-plugin.version>3.5.5</surefire-plugin.version>
     </properties>
 
-    <!-- Override Netty components to a secure version (keep all modules aligned) -->
+    <!-- dependencyManagement overrides for native-image compatibility.
+         Quarkus 3.34.7 manages Netty at 4.1.132.Final which already patches
+         CVE-2025-58057 / CVE-2026-33870 / CVE-2026-33871 (affecting <=4.1.131.Final)
+         and is native-image compatible.  Do NOT override netty-bom here: Netty
+         4.1.133+ changed netty-codec native-image config to register BrotliDecoder
+         for link-at-build-time, which requires brotli4j on the classpath, a
+         dependency we do not include.  Let Quarkus manage Netty at 4.1.132.Final. -->
     <dependencyManagement>
         <dependencies>
-            <dependency>
-                <groupId>io.netty</groupId>
-                <artifactId>netty-bom</artifactId>
-                <!-- Force patched Netty 4.1 version to mitigate CVE-2025-58057 and
-                CVE-2026-33870/CVE-2026-33871 (affecting <=4.1.131.Final).
-                Must stay on 4.1.x — Quarkus 3.x applies a CleanerJava9 bytecode
-                transformation incompatible with Netty 4.2 (see quarkusio/quarkus#53309). -->
-                <version>4.1.135.Final</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
             <!-- Override MCP server to a version with native-image fixes.
                  quarkus-mcp-server-bom:3.34.7 (from root pom) resolves all MCP
                  artifacts to 1.10.5, which predates the native-image fixes added