refactor(build,ci): 현재 상태 검증을 걷어내고 불변조건만 남기는 검증 표면 축소

외부 리뷰("현재 상태를 유지하기 위한 검증이 너무 많고, 그 검증 자체를
다시 검증하는 구조까지 생겼다")를 설계 문서로 정리하고 코드로 반영한다.
설계·판단 근거는 docs/superpowers/specs/2026-09-16-verification-surface-reduction-design.md.

삭제
- .github/ci-gate-matrix.yml(1,025줄) + verify-gate-matrix.sh(568줄):
  Gradle task graph와 workflow graph에 이미 있는 정보의 3중 복제
- verify-gradle-wrapper.sh(799줄): workflow 바이트 해시 잠금.
  wrapper 검증은 gradle/actions/wrapper-validation(full SHA 핀)에 위임
- DeveloperExperienceContractTest 등의 CI YAML mutation 테스트:
  애플리케이션 test suite가 GitHub Actions YAML 파서를 검증하던 계층 역전
- 문서 drift 파서: verifyReadmeCommands, verifyRunbookReferences,
  verifyDocumentedLeafCount, verifyTestSourceSetRegistry
- 빈 레지스트리를 지키던 커스텀 YAML 파서: verifyTrivyignore,
  verifyQuarantineSunset, flaky-quarantine.yaml
- verifyConfigurationPropertiesProcessor, verifyOneTypePerFile:
  각각 ca.spring-config convention과 Checkstyle OneTopLevelClass가 대체
- 정상 입력으로도 성공할 수 없던 messaging always-fail task
- ModuleRegistry의 JSON 필드 집합 정확 일치, sample-portfolio negative guard

이동
- java/quality/spring 공통 설정을 configure(subprojects) 블록에서
  ca.java-conventions / ca.quality-conventions / ca.java-library /
  ca.spring-library convention plugin으로
- 아키텍처 검증을 ca.architecture로, JPA·messaging qualification을
  gradle/qualification/ 아래로, verifyEnvKeys를 :app-bootstrap 소유로

완화
- Git revision은 releaseCheck·아카이브 생성에서만 요구. 일반 빌드는 SNAPSHOT
- SpotBugs/FindSecBugs는 로컬 check에서 빼고 qualityCheck 레인으로

task 계층
- leaf check는 그 leaf만. architectureCheck / qualityCheck /
  configContractCheck / integrationCheck / ci / releaseCheck로 이름 분리

CI
- _reusable-gradle.yml 신규. checkout + wrapper validation + JDK/캐시 공통화
- fileserver-release.yml -> fileserver-certification.yml (CD가 아니라 certification)
- GitHub Actions = CI + artifact, Argo CD = CD 경계를 docs/ci-cd/boundary.md로 고정

순증감 +3,274 / -7,483.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -19,11 +19,13 @@ name: release
 # design one:
 #   * jpa-release.yml — JpaReleaseRenderingTest reads that exact path and holds its PostgreSQL
 #     matrix and promotion list to src/config/jpa/release-registry.json.
-#   * fileserver-release.yml — FileserverDocumentationCoverageTest requires every job id named in
-#     docs/fileserver/support-matrix.md to be defined in a `.github/workflows/fileserver-*.yml`.
+#   * fileserver-certification.yml — FileserverDocumentationCoverageTest requires every job id named
+#     in docs/fileserver/support-matrix.md to be defined in a `.github/workflows/fileserver-*.yml`.
+#     It is named "certification" rather than "release" on purpose: it certifies a storage topology
+#     and a support matrix, it deploys nothing, and the CI/CD boundary in docs/ci-cd/boundary.md
+#     says GitHub Actions does not deploy.
 # Folding either one in needs its src-side test (and, for fileserver, the support document) changed
-# in the same commit. Until then the image job below cannot wait on them, which is what the
-# `container-release-evidence-join` row in .github/ci-gate-matrix.yml records.
+# in the same commit. Until then the image job below cannot wait on them — a stated gap.
 #
 # The image job DOES now wait on the evidence jobs in this file, which is new: while the image build
 # lived in its own workflow it could publish while a sibling suite was still running or already red,
@@ -52,9 +54,6 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
       - uses: ./.github/actions/setup-gradle-java
       - name: Verify architecture boundaries and the published surfaces
         working-directory: src
@@ -62,7 +61,7 @@ jobs:
           ./gradlew
           verifyCleanArchitectureDependencies
           verifyPublicPathSnapshot
-          verifyEnvKeys
+          :app-bootstrap:verifyEnvKeys
           :app-bootstrap:test --tests 'dev.caskeleton.bootstrap.architecture.*'
           --no-daemon
           --stacktrace
@@ -80,9 +79,6 @@ jobs:
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
       - uses: ./.github/actions/setup-gradle-java
       - name: Run every web lane, Stable and Advanced
         working-directory: src
@@ -108,9 +104,6 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
       - uses: ./.github/actions/setup-gradle-java
       - name: Run every websocket lane, Stable and Advanced
         working-directory: src
@@ -151,9 +144,6 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
       - uses: ./.github/actions/setup-gradle-java
       - name: In-process contract lane
         working-directory: src
@@ -172,11 +162,9 @@ jobs:
           path: src/grpc/grpc-testkit/build/reports/tests/
           if-no-files-found: warn
 
-  # Each declared gate runs as its own single-line `./gradlew <task>` step, because
-  # .github/scripts/verify-gate-matrix.sh reads these commands to prove the gate is actually
-  # executed — a folded or flag-laden command would make the declaration in
-  # .github/ci-gate-matrix.yml unverifiable. The architecture dependency gate that used to end this
-  # list is now architecture-and-surface above; it was the fourth copy of the same invocation.
+  # Each gate runs as its own single-line `./gradlew <task>` step so that a failure names the gate
+  # rather than a folded command. The architecture dependency gate that used to end this list is now
+  # architecture-and-surface above; it was the fourth copy of the same invocation.
   httpclient-release-gate:
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -189,9 +177,6 @@ jobs:
       GRADLE_OPTS: -Dorg.gradle.project.performance.assertions.enabled=true
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
       - uses: ./.github/actions/setup-gradle-java
       - name: Focused module tests
         run: ./gradlew :adapter:outbound:httpclient:test --no-daemon --stacktrace
@@ -241,9 +226,6 @@ jobs:
       # The builder stage inside src/Dockerfile runs this repository's Gradle wrapper to produce the
       # JAR that becomes the image. Validating the wrapper here checks the thing that is about to
       # execute, before it executes, rather than after an image already exists.
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
       # The tag is the release identity; everything below derives from it. A tag that does not parse
       # stops the release here, rather than producing an image named after whatever ref happened to
       # be checked out.
@@ -393,8 +375,9 @@ jobs:
       # a green trivy-fs has never been evidence about the artifact.
       #
       # --ignorefile is mandatory here as everywhere: .trivyignore.yaml is the single suppression
-      # source and verifyTrivyignore enforces that each entry carries a rationale and an expiry.
-      # An inline --skip or a second ignore file would be a suppression nobody reviews.
+      # source. Each entry carries a rationale and an expiry by policy, reviewed through CODEOWNERS
+      # (.github/dependency-vulnerability-policy.md); an inline --skip or a second ignore file would
+      # be a suppression nobody reviews.
       #
       # This step is the reason `docker push` is further down. A vulnerable image that was pushed and
       # then reported is already pullable by everything that watches the tag.