GeezerVison

integrate quality gates: PMD + SpotBugs + formatter Maven plugins

the three-layer quality pipeline the static-analysis sweep pointed at:

- maven-pmd-plugin 3.28.0 (PMD engine 7.17): pmd-ruleset.xml with
  errorprone+bestpractices and 19 documented rule exclusions - each
  exclusion is a triaged intentional pattern (boundary dispatchers,
  zero-copy frame ownership, identity semantics, JDK-parity null
  contracts, parser idioms). minimumPriority=4 gates on the P1-P4
  band. the 7.28.0-engine CLI sweep lives in the triage history.

- spotbugs-maven-plugin 4.10.5.0: max effort, threshold Medium, with
  the pattern names 4.10 renamed (EI_EXPOSE_REP etc.) - the 4.9-era
  short codes no longer match. config/spotbugs-exclude.xml carries
  the same triaged families: pre-encoded caches, lifecycle flags,
  no-finalizer CT, wire-format structs in non-exported packages,
  stop-path best-effort close.

- formatter-maven-plugin 2.29.0: mechanical codestyle layer with the
  eclipse profile (user-tuned), bound at process-sources. 155 files
  reformatted. covers the codestyle ground PMD deliberately skips.

new findings the 4.10 engine surfaced and fixed along the way:
- LazyRequestHeaders lacked equals/hashCode (materialize-then-super)
- PriorityFrame/HeadersFrame/UnknownFrame write-only wire fields removed
- FrameHeader.parse: dead null/0 initializers replaced by direct-flow
- Http2Stream/Http2Connection: final OptimizedHeaders fields typed
  tightly, instanceof guards dropped (killed BC_VACUOUS + NP pair)
- Request.addHeader takes the parse table as a parameter (kills the
  NP_ALWAYS_NULL field-flow false positive)
- ServerConfig$1.pkg hoisted to a captured local, WebSocketFrame
  dead >=0 condition dropped, FrameHeader.debug catch narrowed
- javadoc plugin pinned release=25 (maven 3.9 defaulted it to 17,
  where ScopedValue does not resolve)

maven 3.9.10 (>=3.8.9 required by spotbugs 4.10.5.0) required; 240/240
tests green inside a full 'mvn verify' pass of all three gates.