feat: port codeiq from Java/Spring Boot to Go single-binary (Phases 1… #422

	name: Java CI

	# Lean Java CI — fast compile + unit-test gate on the Java reference side.
	# Pairs with go-parity.yml: this workflow proves the Java jar still builds
	# on every PR; go-parity.yml then uses the same build to diff against the
	# Go port.
	#
	# Heavier checks (jacoco coverage, SpotBugs, OWASP dependency-check) live
	# under workflow_dispatch via release-java.yml — they're not in the per-PR
	# loop because they slow the Go port's PRs without adding signal.
	#
	# Disappears in Phase 6 cutover along with the rest of the Java tree.

	on:
	push:
	branches: [main]
	paths:
	- 'src/**'
	- 'pom.xml'
	- '.github/workflows/ci-java.yml'
	pull_request:
	branches: [main]
	paths:
	- 'src/**'
	- 'pom.xml'
	- '.github/workflows/ci-java.yml'

	permissions: read-all

	jobs:
	build:
	name: build
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
	with:
	fetch-depth: 0
	- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v4.7.1
	with:
	distribution: 'temurin'
	java-version: '25'
	cache: 'maven'
	- name: Compile + unit tests (skip frontend)
	# -Dfrontend.skip=true so the npm step doesn't run — CI image
	# doesn't carry node 20 by default and the frontend is owned by
	# a separate workflow. -B (batch) + -ntp (no transfer progress)
	# for quiet logs.
	run: mvn -B -ntp -Dfrontend.skip=true verify
	- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.2
	if: always()
	with:
	name: java-test-results
	path: target/surefire-reports/

Provide feedback