Bump Javy to 7.1.0 and fetch the plugin wasm with inlay

[andreaTP]

Bumps javy-plugin-api from 7.0.0 to 7.1.0 (javy 8.1.0, rquickjs 0.12.2). No source changes were needed.

It also stops committing javy_quickjs4j_plugin.wasm, using the same setup Endive uses for cranelift_bridge.wasm. The inlay Maven plugin now fetches the wasm from ghcr.io/roastedroot/quickjs4j-javy-plugin during generate-sources, pinned by digest in wkg.lock. Building no longer needs a Rust toolchain. inlay skips the download when the file already exists, so a local make -C javy-plugin build still takes priority.

Pipelines

• wasm-publish.yml (new): when a push to main touches javy-plugin/** (or on a manual run), it builds the wasm and publishes it as 999.0.0-SNAPSHOT. It then runs the full test suite with -Dinlay.update and commits the re-pinned wkg.lock. A wasm that fails the tests is never pinned.
• release.yml: retags the tested snapshot digest as the release version, points the javy-plugin.version property at it and re-pins the lock. It refuses to deploy if the property still resolves to a SNAPSHOT tag, and restores the snapshot afterwards. Releases don't need Rust.
  • The digest to retag is selected by the snapshot's version entry in the lock rather than by position, so it stays correct no matter how the lock is ordered once it holds past releases too.
• javy-plugin.yml (new): PRs that touch javy-plugin/** (including Dependabot cargo bumps) are tested against a wasm built from source. Without it they'd be tested against the old pinned wasm.

inlay:fetch is bound to initialize rather than its default generate-sources, because the endive compiler runs in that same phase and spotless sortPom is free to reorder plugin declarations.

Bootstrap

The first 999.0.0-SNAPSHOT was pushed by hand from the same wasm this PR was tested with. The package is linked to this repo and is public. Once this PR merges, wasm-publish.yml runs because Cargo.toml/Cargo.lock changed. It republishes the snapshot and re-pins wkg.lock automatically.

Testing

• Full mvn install passes against the rebuilt wasm.
• Against a local registry: fetch, lock write, skip when the file exists, stale-lock digest mismatch, and the whole release sequence (retag → pin → guard → deploy build → back to snapshot), on both Java 11 and 21.
• Against GHCR: an anonymous fetch with an empty inlay cache returns a wasm byte-identical to the local build.

🤖 Generated with Claude Code