chore(jpms): remove unused requires, promote API-exposed deps to transitive

[eschizoid]

JPMS audit follow-up: tighten module-info.java across the module graph. Build-metadata only — no behavior change. Module-graph changes affect downstream consumers, so each one was verified by grep + a full clean compile (compileJava + compileTestJava across all modules, re-run with --rerun-tasks to defeat caching). All passed.

Part A — remove unused requires

Module	Removed	Verification grep
kpipe-api	requires kafka.clients	grep -rn "org.apache.kafka" lib/kpipe-api/src/main/java/ → no matches (exit 1)
kpipe-consumer	requires java.net.http	grep -rn "java.net.http" lib/kpipe-consumer/src/main/java/ → only match was the module-info.java declaration itself; the health server uses jdk.httpserver / com.sun.net.httpserver, which stays declared

Both removals confirmed safe: no audit-missed usage, and the clean compile across all modules still succeeds.

Part B — promote requires → requires transitive

Each promotion was confirmed by locating the required module's type on a public/exported signature before promoting:

Module	Promoted	Public-API exposure (verified)
kpipe-api	org.apache.avro	KPipe.avro(...) returns Stream<GenericRecord>
kpipe-api	com.google.protobuf	KPipe.protobuf(...) returns Stream<Message>
kpipe-consumer	kafka.clients	Builder.withConsumer(Supplier<Consumer<K,byte[]>>), withKafkaProducer(Producer<K,byte[]>), withOffsetManagerProvider(Function<Consumer<K,byte[]>, …>)
kpipe-producer	kafka.clients	KPipeProducer.Builder.withProducer(Producer<K,V>), send(ProducerRecord), sendAsync(ProducerRecord)
kpipe-metrics-otel	io.github.eschizoid.kpipe.metrics	OtelConsumerMetrics implements ConsumerMetrics (and OtelProducerMetrics implements ProducerMetrics)
kpipe-tracing-otel	io.github.eschizoid.kpipe.producer	OtelTracer implements Tracer (producer.tracing.Tracer)
kpipe-schema-registry-confluent	io.github.eschizoid.kpipe.core	CachedSchemaResolver / ConfluentSchemaResolver implements SchemaResolver
kpipe-format-avro	org.apache.avro	AvroFormat(Schema) ctor, implements MessageFormat<GenericRecord>
kpipe-format-protobuf	com.google.protobuf	ProtobufFormat(Descriptor) ctor, implements MessageFormat<Message>

Deliberately NOT promoted (internal-only, audit-confirmed correct as non-transitive):

• com.fasterxml.jackson.core in kpipe-format-avro — only leaks transitively through Avro's encoder internals; not on KPipe's own public surface.
• com.google.protobuf.util in kpipe-format-protobuf — internal-only (console-sink JSON formatting).

Downstream module-graph impact

This changes the module graph for consumers of the facade. Because kpipe-api now requires transitive org.apache.avro / com.google.protobuf, and the format modules re-export their dependency types, downstream consumers of kpipe-api no longer need to manually requires org.apache.avro / requires com.google.protobuf in their own module-info.java to name GenericRecord / Message from the facade return types. Likewise, consumers of kpipe-consumer / kpipe-producer no longer need a manual requires kafka.clients to name the Kafka types those builders expose.

Verification

• ./gradlew clean compileJava compileTestJava across all modules — BUILD SUCCESSFUL (re-run with --rerun-tasks).
• A wrong requires removal would break compilation; nothing did, so no removal was reverted.

(Note: ./gradlew clean build itself fails in this CI worktree only because the Spotless ratchetFrom("origin/main") jgit step can't resolve the worktree gitdir indirection — unrelated to these changes; module-info.java edits are not Spotless-formatted.)

[eschizoid]

@copilot please review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.56%. Comparing base (be1b873) to head (a04ec44).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #206   +/-   ##
=========================================
  Coverage     78.56%   78.56%           
  Complexity      749      749           
=========================================
  Files            66       66           
  Lines          2818     2818           
  Branches        359      359           
=========================================
  Hits           2214     2214           
  Misses          443      443           
  Partials        161      161           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.