Audit unresolved Copilot review threads from merged PRs

[fabian-barney]

Problem

Merged pull requests still have unresolved GitHub Copilot review threads.
Each thread needs an explicit classification and closure path instead of being left open.

Intended outcome

• Classify each listed thread as valid or invalid against current main.
• Fix valid findings that still apply in focused follow-up PRs.
• Reply with evidence when a finding is invalid or already fixed by later work.
• Resolve the thread when GitHub permits it; otherwise record why it is unresolvable.

Threads

• PR Remove crap-java GitHub Packages consumption #38, $loc: Remove crap-java GitHub Packages consumption #38 (comment)
  Finding: Switching the gate to ./mvnw ... verify only works if the crap-java check goal is lifecycle-bound. In the current POM the crap-java-maven-plugin execution doesn’t declare a pha...
• PR Remove crap-java GitHub Packages consumption #38, $loc: Remove crap-java GitHub Packages consumption #38 (comment)
  Finding: The JaCoCo report execution is bound to verify, but it isn’t configured to emit an XML report. The report goal commonly defaults to HTML-only; if the crap-java gate (and the ...
• PR Harmonize quality gate execution #42, $loc: Harmonize quality gate execution #42 (comment)
  Finding: quality-gates-all is marked activeByDefault, which Maven deactivates as soon as any profile is explicitly enabled (e.g., -Pnullaway or -Prelease). That can unintentionally ...
• PR Harmonize quality gate execution #42, $loc: Harmonize quality gate execution #42 (comment)
  Finding: The cognitive-java plugin execution no longer specifies a lifecycle <phase>. Since CI now runs ... verify (instead of invoking cognitive-java:check directly), this risks th...
• PR Harmonize quality gate execution #42, $loc: Harmonize quality gate execution #42 (comment)
  Finding: The commands described as “isolate only the crap-java gate” still run the full Maven verify lifecycle (tests + other verify-phase plugins), just with one gate plugin enabled. C...
• PR ci(release): use Maven Central secrets #71, $loc: ci(release): use Maven Central secrets #71 (comment)
  Finding: gpg --list-secret-keys can succeed even if the imported key is only a public key (or if no secret key is present), so this step may not actually “fail early” for malformed sign...

Notes

This issue is audit/remediation tracking only. It should not bundle unrelated repo changes.