interop/tinkerpop: bound downloads, build classpath from deps.lock

fetch-deps.sh: each curl attempt gets --connect-timeout 20 --max-time 120,
so a stalled transfer times out and the retry loop advances instead of
eating the job's time limit. The final count reads deps.lock, not lib/.

run.sh: the classpath is built from the jars pinned in deps.lock, never a
lib/ wildcard, so a stale jar left in lib/ cannot shadow a pinned one. A
missing pinned jar fails with a pointer to fetch-deps.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AhMhXd2gDhYzTgwKeHaWHB

Author: claude

interop/tinkerpop/fetch-deps.sh

@@ -13,10 +13,11 @@ grep -v '^#' deps.lock | while read -r coord sum; do
     # Maven Central answers 429 under bursts; back off and retry a few times.
     for delay in 0 2 4 8 16; do
       sleep "$delay"
-      if curl -fsS -o "$jar.part" "$url"; then break; fi
+      # Bound each attempt: a stalled transfer must time out so the loop advances.
+      if curl -fsS --connect-timeout 20 --max-time 120 -o "$jar.part" "$url"; then break; fi
     done
     mv "$jar.part" "$jar"
   fi
   echo "$sum  $jar" | sha256sum -c --quiet - || { echo "checksum mismatch: $jar" >&2; rm -f "$jar"; exit 1; }
 done
-echo "deps ok: $(ls lib/*.jar | wc -l) jars"
+echo "deps ok: $(grep -cv -e '^#' -e '^$' deps.lock) jars"

interop/tinkerpop/run.sh

@@ -10,7 +10,16 @@ J="${LGJ_JDK:-/opt/jdks/jdk-28}/bin"
 SO="$root/native/lgj-abi/target/release/liblgj_abi.so"
 out="$here/out"
 rm -rf "$out" && mkdir -p "$out"
-cp="$(ls "$here"/lib/*.jar | tr '\n' ':')"
+# The classpath is exactly the jars pinned in deps.lock, never a lib/ wildcard:
+# a stale jar left in lib/ must not shadow a pinned one.
+cp=""
+while read -r coord _; do
+  [ -z "$coord" ] && continue
+  IFS=: read -r _ a v <<<"$coord"
+  jar="$here/lib/$a-$v.jar"
+  [ -f "$jar" ] || { echo "missing $jar; run ./fetch-deps.sh" >&2; exit 1; }
+  cp="$cp$jar:"
+done < <(grep -v '^#' "$here/deps.lock")
 if ! "$J/javac" --release 28 --enable-preview -d "$out" -cp "$cp" \
   $(find "$root/java/src/main" "$root/java/src/test" "$root/consumers/graph/src/main" "$here/src" -name '*.java') \
   >"$out/javac.log" 2>&1; then