CI: test Maven 4 on 4.0.0-rc-7 (#267)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #267

What

The nightly full tier tested Maven 4 on 4.0.0-rc-6. 4.0.0-rc-7 is now the newest Maven 4 release on Maven Central, so the 4.x pin was stale (the "stale 4.0 RC" part of #267). This moves both 4.x legs of e2e-extended to rc-7:

• e2e_redirect_maven_build e2e_vendor_maven_build, maven 4.0.0-rc-7
• e2e_vendor_jvm_build --ignored maven_reactor, maven 4.0.0-rc-7

scripts/maven-sha512.json drops the rc-6 pin and adds rc-7's SHA512, taken from Apache's published apache-maven-4.0.0-rc-7-bin.tar.gz.sha512 (archive.apache.org) and matched against the downloaded tarball. docs/design/maven-vendoring.md names the new pin and now says which tier runs each Maven version (it said "the PR tier", but since lean CI only 3.9.16 runs on PRs). Two code comments that cite the Maven 4 release they were checked against now say rc-7.

Runner usage

Same legs in the same tier (full tier only: schedule / dispatch / CI_SCOPE=full). Lean PR and merge-queue runs: before ~28 Linux jobs / ~32 job-min, after the same. No change.

Not in this PR (stays open on #267)

• A Windows e2e_redirect_maven_build / e2e_vendor_maven_build leg.
• A Maven 3.10 leg (3.10.0 GA is now out).
  Both add full-tier jobs, so they need a call on nightly cost first.

Test evidence

Local, against the downloaded apache-maven-4.0.0-rc-7 (mvn -v: Apache Maven 4.0.0-rc-7 (6d8f301b), Java 21), with the env CI sets (SOCKET_PATCH_MAVEN_E2E_REQUIRED=1, SOCKET_PATCH_MAVEN_E2E_VERSION=4.0.0-rc-7, so the suite fails if mvn -v reports another version; maven_build_common/mod.rs:155):

• e2e_redirect_maven_build --ignored: 1 passed
• e2e_vendor_maven_build --ignored: 1 passed
• e2e_vendor_jvm_build --ignored maven_reactor: 1 passed
• python3 -m pytest scripts/tests -q: 342 passed, 6 skipped (includes test_every_matrix_version_has_a_sha512_pin)
• actionlint and zizmor --offline on ci.yml: same output as on origin/main (no new findings); the workflow YAML parses.
• cargo fmt --all -- --check, cargo clippy -p socket-patch-core --all-features -- -D warnings: clean (only comments changed in Rust files).

No full-scope dispatch: no platform-specific code changed, and the three rc-7 suites already pass locally, so one full matrix run (~90 jobs) wasn't worth the runners.

/code-review high: findings not fixed here

• rc-6 is dropped rather than kept next to rc-7: intended. The 4.x leg tracks the newest Maven 4 release, the way the issue asks; keeping both would add a full-tier leg.
• Commit trailers use Assisted-by: rather than Co-Authored-By:, per this repo's agent conventions.

🤖 Generated with Claude Code

https://claude.ai/code/session_0132UUYumjHCgWoZX7hDMGqD

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8fc25a3. Configure here.}