feat(java): standalone nvcf_java_rules + nv_boot_parent Bazel modules

[balajinvda]

Why

Java was the last language in the repo still on a shared root Maven hub
(@nv_third_party_deps) and absolute cross-subtree source labels
(//src/libraries/java/nv-boot-parent/...). Go and Rust services are already
self-contained nested Bazel modules with their own MODULE.bazel, lockfile, and
CI matrix row. This makes Java match that pattern so each library and service
builds, tests, and pins its own dependencies from its own directory, and so
nv_boot_parent is reusable by every Java service (in-tree via
local_path_override, out-of-tree via git_override + strip_prefix).

Foundation of the target architecture in docs/bazel-java-architecture.md.

What changed

Four standalone Bazel modules:

• rules/java -> nvcf_java_rules: shared macros (nvcf_java_library,
  nvcf_spring_boot_image), platform.bzl (SPRING_BOOT_BOM,
  MAVEN_REPOSITORIES, version constants), a vendored self-contained
  create_oci_image (drops the //rules/oci dependency), and
  bom_alignment_test.
• src/libraries/java/nv-boot-parent -> nv_boot_parent: the Spring platform
  library with its own @maven hub + maven_install.json; notice tooling
  repointed at the module-local lockfile.
• src/control-plane-services/cloud-tasks -> nvct_cloud_tasks: the service,
  own @maven hub incl. gRPC codegen, bazel_deps both nvcf_java_rules and
  nv_boot_parent.
• examples/java-spring-boot-service -> nvcf_java_example: the reference
  template. Migrated because it also consumed //rules/java +
  @nv_third_party_deps and would otherwise break the root build.

Maven BOM alignment: load() is forbidden in MODULE.bazel, so each module
inlines the canonical BOM list and guards it with bom_alignment_test, which
fails the build if a module's boms drift from SPRING_BOOT_BOM in
platform.bzl. This keeps the independent per-module resolutions in agreement
without a shared hub.

Root + CI wiring: the three app/lib module paths are added to .bazelignore
(rules/java is not, since it declares no root-referencing targets); cloud-tasks
is dropped from ROOT_GLOBS and src/libraries/ is narrowed to
src/libraries/go/. bazel.yml gains nv-boot-parent, cloud-tasks, and
java-spring-boot-service rows (build + test); like all non-root rows they get
EC2 Buildbarn cache hits via the workflow's remote-cache injection.
ci/Dockerfile.bazel gains an additive remotejdk_25 + Bazel 9.1.1 pre-warm;
bazel-ci-image.yml bumps to 0.13.0 (builds on this PR, publishes on merge). The
bazel.yml consumer ref stays at 0.12.0 until 0.13.0 is published, so the matrix
never pins an unpublished image.

Customer Release Notes

Not customer visible (build/CI only).

Plan Summary

Not applicable.

Usage

cd src/libraries/java/nv-boot-parent && bazel build //... && bazel test //... --test_tag_filters=-requires-docker
cd src/control-plane-services/cloud-tasks && bazel build //...
cd examples/java-spring-boot-service && bazel test //...

Re-pin a module after editing its maven.install: REPIN=1 bazel run @maven//:pin.

Testing

Verified standalone from each module directory (local, cache-cold):

• nvcf_java_rules: bazel build //... OK.
• nv_boot_parent: bazel build //... OK (42 targets); bazel test //... --test_tag_filters=-requires-docker -> 17/17 pass incl. bom_alignment_test
  and notice_check_test.
• nvct_cloud_tasks: bazel build //... OK (1743 actions, gRPC codegen +
  nv_boot_parent consumed as a module); bom_alignment_test passes.
• nvcf_java_example: bazel build //... + 3 tests pass incl.
  bom_alignment_test.
• Root workspace bazel build --nobuild //... analyzes clean with the Java dirs
  ignored.

Notes

• Draft: do not merge. The bazel.yml image ref -> 0.13.0 is a fast-follow once
  the CI image publishes on merge (staged to keep this PR's matrix green).
• Maven jars are not baked into the shared CI image; per-subtree actions/cache
  for now (eviction caveat), durable remote-downloader fix tracked in byoo-otel-collector re-downloads Go SDK + collector dep graph every CI build (repo-cache eviction) #373.

References

#372

Related Merge Requests/Pull Requests

Stacked on the cloud-tasks Bazel work (#343).

Dependencies

No new third-party libraries. Adds Bazel module deps already used elsewhere in
the repo (rules_java 9.3.0, rules_jvm_external 7.0, contrib_rules_jvm 0.33.0,
rules_oci, rules_pkg, aspect_bazel_lib, rules_proto_grpc[_java], toolchains_protoc).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b48cb4ae-70bd-4454-8bd2-be8646dc1eea

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/java-standalone-modules

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-feat-java-standalone-modules.docs.buildwithfern.com/nvcf

[balajinvda]

Consolidated into #343 to avoid two PRs for one piece of work. The standalone-module commit (8f0b9384) was cherry-picked cleanly onto #343's head, so #343 now carries the standalone modules + matrix rows + JDK pre-warm together with the openapi sync and zip-slip fix. Closing this in favor of #343.