fix: align Java 17 runtime compatibility

[imbajin]

Purpose of the PR

PD/Store serialization and Console authentication initialization can print a Java 17 module-access exception while returning success. Tests could therefore pass with incompatible runtime arguments. This follows up on the Java 17 migration in #3261.

The same required component options now apply to launchers, Surefire and cluster nodes. Positive tests and smoke checks fail when their current-run logs contain denied module access or unsupported JVM options.

Main Changes

• Add the minimal Hessian java.lang permission to PD and Store component option files. Console and store-dump reuse Server's option file; custom JVM options cannot replace the required permissions. Missing or unreadable option files fail immediately.

• Open java.nio for HBase's Bits.unaligned() initialization and java.lang for SOFA RPC's Throwable.cause access in Server, both confirmed by runtime diagnostics.

• Reuse one log checker for positive Maven suites, startup and Console smoke, and the existing native smoke. Capture stdout, stderr and active background-service logs while preserving command exit status and native-specific checks.

• Forward complete cluster text logs into the captured suite output before node-directory cleanup. Preserve original logs and fail the log check if they cannot be read or the node is still running.

• Preserve the reduced CI policy after rebasing: log-checker contracts run in their executing suites, test-only changes do not trigger post-merge smoke, and RISC-V reuses its generated distribution without another Maven JVM launch.

Dependency versions and persisted formats remain unchanged.

Verifying these changes

• Trivial rework / code cleanup without any test coverage. (No Need)
• Already covered by existing tests.
• Need tests and can be verified as follows:
  • Java 17 clean compile, distribution packaging, EditorConfig formatting, launcher contracts, checker fixtures and workflow validation passed locally.
  • Actual PD/Store serialization, Console authentication initialization, and HBase/SOFA RPC initialization probes passed with the required options. Without them, the checker detected caught access exceptions even when the JVM returned success. The HBase probe selects its x86 reflection branch on the ARM host.
  • Cluster unit tests and the actual simple-cluster suite passed, including complete log forwarding and preservation on unreadable logs.
  • Native startup, persisted writes, restart verification, store-dump and remote Console smoke passed on the local ARM host with the distribution logging configuration selected explicitly.
  • After rebasing onto the CI changes, Java 17 compile, native timeout/restart/cleanup contracts, policy regressions, cluster launcher tests and workflow validation passed again. The final integration diff was independently reviewed.
  • Launcher fixtures copy each component's own module options. Fresh PD/Store-only runs and both component orders pass with the real Java 17 JVM; this checks launcher arguments without starting the applications.
  • Remaining backend and full-suite validation runs in CI at the updated head.

Does this PR potentially affect the following parts?

• Dependencies
• Modify configurations
• The public API
• Other affects: launcher consistency and CI failure criteria
• Nope

Documentation Status

• Doc - TODO: required documentation is pending; complete it before merging.
• Doc - Done: documentation is included here or linked below.
• Doc - No Need: no user-visible documentation is affected.

Documentation files in this PR: docs/server-runtime.md, docs/ci.md, hugegraph-pd/README.md, and hugegraph-store/README.md.

Implementation overview

Conceptual overview of #3336: reuse component-specific JVM options across entry points, add the required Hessian/HBase/SOFA permissions, and check current-run logs before accepting positive tests. Cluster text logs are forwarded before cleanup; inspection failures preserve evidence. This diagram describes the design, not a completed CI or runtime acceptance result.

[bitflicker64]

Blocking: yes. Summary: The shared module options and launcher changes read correctly and their fixture tests pass, but the new log gate fails the HBase API suite at this head, because Server's bin/jvm-module.options does not open java.nio and the HBase client prints a caught InaccessibleObjectException on every start. Evidence: Server Compatibility CI run 38376376283, job build-server-backends / server_hbase (Java 17), step Run api test exits 1 from check-java-runtime-logs.sh after 183 API tests ran with 0 failures; the same job on master 0b7c0de3 (run 38364779759) prints the same exception and passes. Locally at this head test-check-java-runtime-logs.sh, test-java17-upgrade-contracts.sh and the PD and Store --gc-only launcher fixtures pass. HugeGraph-Server CI (pd_store, cluster, server-rocksdb, startup contracts) was still queued at review time, so the new gate has no result yet for those suites.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.29%. Comparing base (92af2f8) to head (a9398b8).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3336      +/-   ##
============================================
- Coverage     54.31%   54.29%   -0.02%     
- Complexity     2250     6310    +4060     
============================================
  Files           770      770              
  Lines         67952    67952              
  Branches       9213     9213              
============================================
- Hits          36905    36894      -11     
- Misses        27470    27482      +12     
+ Partials       3577     3576       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[bitflicker64]

Blocking: no. Summary: The shared jvm-module.options wiring for PD, Store, Console, dump-store, Surefire and the cluster wrappers reads correctly at this head, and the java.nio open requested on the earlier head is now in Server's option file. One minor gap remains in the log checker: a log that contains a NUL byte is reported clean. The gated suites have no CI result at this head yet, so the new gate and the HBase fix are not confirmed by a run. Evidence: full diff 0b7c0de..4c57ce0 read with the launchers, both assembly descriptors, the Surefire argLine chain (<argLine /> in the root pom), AbstractNodeWrapper and the CI scripts at this head; test-check-java-runtime-logs.sh passes locally; a two-line probe log run through check-java-runtime-logs.sh (macOS, BSD grep 2.6.0) exits 0; HugeGraph-Server CI run 38413946167 was still queued and Server Compatibility CI run 38413946356 was cancelled with server_hbase (Java 17) stopped inside Run core test, before Run api test.

[bitflicker64]

Blocking: no. Summary: The component jvm-module.options files reach every launcher, Surefire and the cluster wrappers at this head, both points from the earlier reviews are fixed (java.nio is open for HBase and the checker reads logs that contain NUL bytes), and the gated suites are green. One minor gap remains in a fixture this PR does not touch: test-launcher-gc.sh runs the PD and Store launchers against Server's option file. Evidence: full diff of abda50a read with the launchers, both assembly descriptors, the Surefire argLine chain, AbstractNodeWrapper and the CI scripts; run 38465528311 at this head passes server_hbase (Java 17), pd_store (pd, store, hstore, struct), cluster-test, server_rocksdb, commons, macOS ARM (full) and build-server-riscv64; locally (macOS arm64, OpenJDK 17.0.20.1) test-check-java-runtime-logs.sh, test_ci_policy.py (21 tests) and test-launcher-gc.sh pass. dependency_license / dependency-review fails with Dependency review detected vulnerable packages after warning that the base SHA has 0 snapshots against 1 for head; this diff adds no dependencies.