v2.8.0 — read the save, start the JVM, and say which source won

x4save reads a savegame and says what it would silently lose — the save is the only artifact the
engine wrote, so it answers two questions no manifest can: which extensions are baked into the save,
and what content it references that the live tree no longer defines.

CI had never once started a JVM. The BaseX jar has shipped vendored since 2.6.0 and all 24 of its
tests mocked java. CI now installs Temurin 17 and runs a real collection() query against the real
jar — proven able to fail three ways. setup.sh also probes for Java, which README.md had been
promising as a prerequisite without anything checking it.

Provenance now says which source WON, not which INTRODUCED it. A root <replace sel="//macros">
swaps a whole document, so base contributes no chain entry at all — and that is VRO's dominant
idiom, 848 of them. A single-entry chain therefore read as "this mod introduced this value" when it
usually means "this mod re-supplied what vanilla already had."

MEASURED: of 35,423 single-op root-replace attributes, 23,182 (65.4%) also exist in vanilla
with the chain hiding it; only 39 vpaths are genuinely mod-added. who-sets and dump --chain
now disclose when base+DLC also supply the vpath, and stay silent where there is nothing to disclaim.

Also fixed: a store could be stamped with a fingerprint describing a world it was never built from;
a guard that caught a vanishing CLI but not a new one; and a line-ending pin that was declared but
never checked against the bytes it governs — 14 of 155 pinned files still held CRLF, including two that
bash sources, where it is functionally fatal rather than cosmetic.

Under the hood, mutation coverage went from one module to six — 15 mutants, killed 15/15. Every
detector it names is now provably killable rather than assumed so.

Full detail in CHANGELOG.md; every finding is recorded individually in docs/TRUST.md's register
with a measured cost.