EN 16931 Semantic JSON 0.9.8

Added

• Linux packages and package repositories: the native executable as esj_<version>_<arch>.deb
  and esj-<version>-1.<arch>.rpm for x86_64 and arm64, built with nfpm (dist/packages.sh,
  nfpm 2.47.0 pinned by SHA-256 in dist/nfpm.sh), attached to the release with their checksums
  and build provenance attestations, and published in an apt repository and a dnf repository at
  https://apt.bsnsoft.de, served by GitHub Pages from the branch gh-pages:
  apt-get install esj and dnf install esj after adding a keyring and a source line or a
  .repo file (docs/install.md). The executable is
  installed under /usr/lib/esj beside its shared libraries, with /usr/bin/esj a link to it;
  the packages require glibc 2.34 and zlib and nothing else, measured on debian:12-slim,
  ubuntu:22.04, ubuntu:24.04, fedora:latest and rockylinux:9 (dist/packages-smoke.sh).
  A release goes to the suite stable, a pre-release to testing as 1.2.3~rc.1, which sorts
  before 1.2.3. The indices are signed with the release key, the key the artefacts on Maven
  Central are signed with, inline and detached (InRelease, Release.gpg, repomd.xml.asc),
  and so is every rpm; apt reads the indices by hash. dist/repositories.sh regenerates both
  repositories from the packages on the branch, which is their whole state; the job Package
  repositories of release.yml runs it on a tag, and dist/repositories-test.sh puts both
  through apt and dnf end to end with a throwaway key and the commands of the install page, in
  the CI and before a release attaches anything.
• dist/checks.sh fails a native Linux executable, or a library beside it, that needs a glibc
  symbol version newer than ESJ_GLIBC_FLOOR (2.34), the floor the packages require; the native
  build and dist/packages.sh run the check.

Fixed

• esj serve kept the connection of an early refusal alive — an answer sent before the request
  body was read to its end — though it closes that connection where the lingering read of the
  rest ends at its time bound or at the bound of the door; a client that had already sent its
  next request on it lost that answer (HTTP/1.1 header parser received no bytes: once in 420
  requests on a CI runner, in a test run some 3.5 s longer than usual, past the test's 3 s
  bounds; every time behind a chunked body past the bound). Such an answer now says
  Connection: close, so the next request goes on a new connection; a request whose body was
  read to its end keeps its connection.
• The native executables ended esj render --template with exit 5 on a JPEG letterhead or logo
  (NoSuchMethodError: …JPEGImageReader.readInputData) and on every PNG that is not plain RGB or
  a palette — with an ICC profile or an sRGB chunk, in grey, interlaced or with an alpha channel
  (sun/java2d/Disposer, CMMException): no case had used such an image, so the native image
  lacked the JNI and resource metadata of the JPEG decoder, of the rasters and colour models of
  ImageIO and of the colour management of the Java runtime. Four template cases over
  dist/artwork/ record it, and the smoke compares their renderings with the jar's.