## What changed and why

<!-- Summarize the behavior, architecture boundary, or policy being changed. -->

## Verification

- [ ] I ran the focused test for each changed leaf.
- [ ] I ran `cd src && ./gradlew check verifyPublicPathSnapshot verifyDependencyLocks`.
- [ ] I did not add an unregistered production module dependency.
- [ ] Dependency changes include refreshed `gradle.lockfile` files and a strict-lock verification.
- [ ] Trivy suppressions include an owner-reviewed reason and an expiry within 90 days.
- [ ] Any quarantined test is registered in `flaky-quarantine.yaml` with a reason, issue, and
      `quarantined_since` date.
- [ ] I documented checks that could not run and their remaining risk.

## Compatibility and operations

<!-- Note public API/config changes, migration needs, rollout/rollback impact, and external blockers. -->