Harden Reqover 0.1.0 and prepare 2026 OSS contest submission

[TaeHuiKKIM]

What changed

• harden the 0.1.0 Java agent with fail-closed package selection, protected runtime packages, atomic class-ID collision handling, shaded ASM, and embedded license notices
• align Spring Boot and transitive dependencies, Java 17 bytecode/JDK 17 and 21 verification, Maven metadata, source JARs, and reproducible CycloneDX dependency inventory
• add stronger MVC/WebFlux process E2E coverage, thread-hop and concurrent-request isolation checks, safe loopback demo scripts, and an explicit integration guide
• add pinned CI and release workflows with SBOM lock verification, OSV gating, checksums, release bundle contents, Dependabot, CODEOWNERS, and release notes
• refresh README evidence and architecture/limitations, retain raw release-candidate performance evidence without making a comparative performance claim
• prepare the official 2026 OSS contest result-report draft, required SBOM table, three-minute video script/subtitles, and five-slide recording deck

Why

The contest performs source, functionality, and license verification. The previous repository state did not provide a safe no-option agent behavior, final dependency/license evidence, a guarded release path, or a complete submission package tied to the current Java product.

Validation

• JDK 17 clean build: 35 tests, 0 failures/errors/skips
• Temurin JDK 21 clean build: 35 tests, 0 failures/errors/skips
• MVC and WebFlux agent demos, WebFlux thread-hop attribution, no-option startup, concurrency isolation, and occupied-port failure path
• CycloneDX 1.6: 105 components / 106 dependency entries; checked-in lock matches; 96 external Maven components; OSV findings 0
• agent JAR includes Reqover/ASM notices, contains no original ASM package, and contains relocated ASM
• actionlint passed; gitleaks scanned 30 commits and the working tree with 0 findings
• official report renders as 4 body pages plus 5 SBOM pages; 9 highlighted placeholders remain only for team/registration/video facts that cannot be inferred from the repository