Fix v0.4.1 review findings

[perNyfelt]

Summary

• Pin Java 21 toolchains across all modules, run Spotless/SpotBugs in the default build, scan module dependencies with the aggregate OWASP task, and select JavaFX natives by OS and JVM architecture.
• Harden null/EOF handling in gi-console, gi-fx, and gi-swing; add Windows shell coverage and urlExists debug diagnostics in gi-common.
• Merge duplicate fat-JAR metadata and make release-note promotion/version validation safe to retry. Update docs, changelog, and the linked implementation plan (req/v0.4.1-fixes.md).

Verification

• ./gradlew clean build and ./check.sh passed; ./gradlew test passed (116 tests).
• All four modules report a Java 21 toolchain; class-file major version is 65.
• No duplicate paths in the three fat JARs; merged Groovy extension registrations remain present.
• Release fixtures, script syntax/dry run, and workflow YAML checks passed.

Platform and scan notes

• The new Windows smoke job and non-Linux JavaFX classifier paths require CI/platform verification.
• The live OWASP feed scan was not run locally because it requires an NVD API key; the aggregate task was verified with --dry-run.
• SpotBugs completed but emitted missing-class analysis warnings for Tika/CommonMark in downstream modules.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Release-critical shell helpers lack committed automated coverage, and the implementation plan contains stale status and path documentation.

Review effort: Lite
Findings: None

What changed in this PR

This PR addresses v0.4.1 findings across build tooling, runtime handling, packaging, release automation, CI, and documentation.

Changes:

• Pins Java 21 and enables static/dependency analysis.
• Improves platform handling and null/EOF safety.
• Hardens fat-JAR and release-note workflows.

File	Summary
TODO.md	Tracks completed fixes.
req/​v0.4.1-fixes.md	Documents implementation and verification steps.
release.sh	Validates versions and updates release notes.
release.md	Records release fixes.
release-lib.sh	Adds reusable release helpers.
gi-swing/​src/​main/​groovy/​se/​alipsa/​gi/​swing/​InOut.groovy	Guards null matrix handling.
gi-swing/​build.gradle	Applies platform conventions.
gi-fx/​src/​test/​groovy/​se/​alipsa/​gi/​fx/​TableDataTest.groovy	Tests table behavior.
gi-fx/​src/​test/​groovy/​se/​alipsa/​gi/​fx/​InOutHelperTest.groovy	Updates helper coverage.
gi-fx/​src/​main/​groovy/​se/​alipsa/​gi/​fx/​Viewer.groovy	Improves matrix and title handling.
gi-fx/​src/​main/​groovy/​se/​alipsa/​gi/​fx/​InOut.groovy	Removes redundant identity logic.
gi-fx/​build.gradle	Applies JavaFX platform conventions.
gi-console/​src/​test/​groovy/​se/​alipsa/​gi/​console/​ConsolePromptTest.groovy	Covers console edge cases.
gi-console/​src/​main/​groovy/​se/​alipsa/​gi/​console/​InOut.groovy	Handles null, filename, and EOF cases.
gi-common/​src/​test/​groovy/​se/​alipsa/​gi/​FileUtilsTest.groovy	Tests null resource handling.
gi-common/​src/​test/​groovy/​se/​alipsa/​gi/​AbstractInOutTest.groovy	Tests shell and URL behavior.
gi-common/​src/​main/​groovy/​se/​alipsa/​gi/​AbstractInOut.groovy	Adds shell helpers and URL diagnostics.
docs/​PUBLISHING.md	Documents release contracts.
docs/​DEPENDENCIES.md	Updates dependency and packaging guidance.
docs/​API-Guide.md	Documents runtime behavior.
buildSrc/​src/​main/​groovy/​se.alipsa.gi.javafx-platform.gradle	Selects platform-specific JavaFX classifiers.
buildSrc/​src/​main/​groovy/​se.alipsa.gi.fatjar-conventions.gradle	Merges fat-JAR metadata.
build.gradle	Configures toolchains and analysis tasks.
AGENTS.md	Updates build instructions.
.github/​workflows/​ci.yml	Updates CI and adds Windows coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.