Release 2609.0.116

Run the jobs that build no native image on Temurin

setup-java takes the JDK distribution from .tool-versions' vendor prefix and
ignores its own distribution input, so codeql-analysis, sonarcloud and the
deploy job in main.yaml asked for a JDK and got graalvm-community. Each spent
minutes installing a native-image compiler it never runs, and sonarcloud.yaml
carried a comment explaining that its distribution input was decorative.

Those three jobs pin an exact Temurin version instead, the way the action SHAs
and .tool-versions already are, so a JDK change arrives as a commit CI ran
before it merged. The jobs that do build a native image still read
.tool-versions.

Nothing was bumping .tool-versions either: Renovate's mise manager maps only
adoptopenjdk- and temurin- java versions to a datasource and returns undefined
for anything else, which is why that pin has not moved since it was added. A
custom manager reads it against graalvm/graalvm-ce-builds' jdk-* tags, which
are exactly the versions mise offers as graalvm-community-*, and a second one
keeps the workflow versions current.

Generated by chorito 2609.0.119.

Claude-Session: https://claude.ai/code/session_012Z6q2rdcgaj95YRyZxFMDc