refactor: 각 어댑터터별 리펙토링 진행

.github/workflows/jpa-nightly.yml

@@ -119,10 +119,14 @@ jobs:
             src/**/*.gradle
             src/**/gradle-wrapper.properties
             src/**/gradle.lockfile
-      - name: Measure pool saturation and REQUIRES_NEW pressure
+      - name: Verify pool saturation and REQUIRES_NEW connection behaviour
         working-directory: src
-        # Machine-dependent bounds are reported rather than asserted unless explicitly enabled, so a
-        # noisy shared runner does not produce a red build that means nothing.
+        # A behaviour contract, not a measurement. This step used to switch assertions off with an
+        # explicit property and call the result a certification, so the only threshold it ever
+        # asserted was that thresholds were not being asserted. What
+        # it checks now — that REQUIRES_NEW needs two connections per concurrent thread, that a
+        # saturated pool reports its pending count, that a caller waits rather than proceeding
+        # without a connection — is true on any runner, so there is nothing to switch off.
         run: >-
           ./gradlew
           :adapter:outbound:persistence-jpa:jpaPlatformPoolContractTest

.github/workflows/jpa-release.yml

@@ -1,8 +1,13 @@
 name: jpa-release
 
-# The release gate. Every item in docs/jpa/support-matrix.md's gate table has a job or an assertion
-# here, and JpaReleaseManifest parses that document so a gate removed from the docs fails the build
+# The release gate. src/config/jpa/release-registry.json is the source: every gate it declares has a
+# job or an assertion here, JpaReleaseRenderingTest holds this file's matrix and promotion lists to
+# the registry's Stable majors, and verifyJpaReleaseGateTasks resolves each gate's task against the
+# real Gradle graph. So a gate removed from the registry, or a major demoted in it, fails the build
 # rather than quietly ceasing to be checked.
+#
+# The matrix below is therefore not free to drift: editing it without editing the registry fails the
+# unit lane.
 
 on:
   workflow_dispatch:

.github/workflows/messaging-certification.yml

@@ -0,0 +1,59 @@
+# The messaging platform's broker certification lane.
+#
+# Separate from ci-quality-gates.yml because it needs a container runtime and several minutes of it.
+# The lane deliberately carries no Docker guard: every other container suite in the messaging tree
+# skips with a stated reason when Docker is absent, and a certification lane that skipped would
+# report success for a broker nobody started — which is the exact claim the evidence exists to rule
+# out.
+#
+# The job runs the evidence gate rather than the lane, and the gate depends on the lane. What it
+# proves is not only that the scenarios pass but that the committed manifest
+# (messaging-testkit/src/main/resources/messaging/broker-certification-evidence.jsonl) is what this
+# run produced, so "certified against a live broker" cannot be restored by editing a file.
+name: messaging-certification
+
+on:
+  pull_request:
+    paths:
+      - "src/messaging/**"
+      - ".github/workflows/messaging-certification.yml"
+  schedule:
+    - cron: "41 4 * * 3"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  # Reuse would hand one scenario the broker another scenario had already faulted.
+  TESTCONTAINERS_REUSE_ENABLE: "false"
+
+jobs:
+  broker-certification:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - name: Validate Gradle wrapper
+        id: gradle-wrapper-validation
+        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Certify the Kafka adapter against a real broker
+        working-directory: src
+        # GITHUB_SHA is read by the lane and written into every evidence line, because "certified"
+        # is a claim about one source tree.
+        run: ./gradlew :messaging:messaging-kafka:verifyMessagingCertificationEvidence --no-daemon --stacktrace
+      - name: Publish the certification evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
+        with:
+          name: messaging-broker-certification-evidence
+          path: src/messaging/messaging-kafka/build/messaging-certification/
+          if-no-files-found: warn