Java 21 baseline across all JVM modules

All 13 JVM poms declare Java 17. Moving the baseline to Java 21.

(Java 25 was evaluated and rejected: Flink 2.x supports 17/21, and the pinned Lombok 1.18.38 predates JDK 25 support.)

Scope:

• Bump the version in one place via the shared parent from #1.
• Switch the root pom from <source>/<target> to <release>. With source/target, javac links against the host JDK API, so a jar can compile clean and then NoSuchMethodError on a real baseline JVM. Two ports already do this correctly; the flagship module does not.
• Add maven-enforcer-plugin requireJavaVersion, optionally a toolchain, and commit a Maven wrapper — nothing currently enforces or provisions the JDK.
• Bump Lombok to keep a future JDK 25 evaluation unblocked.
• Add the runtime --add-opens flags to the launcher scripts; they exist for surefire but not for java -jar / mvn exec:java.

Verified: the main module builds and all 770 tests pass on JDK 21 today, so the bump is expected to be mechanical.

Roadmap epic. Detailed findings, file:line citations and sub-tasks live in the AI-grind tracker (project AGS), which is the source of truth for this work. Local dev — build, test, tracking, profiling — is managed with AI-grind.

Tracked as AGS-2 in the devtools-mcp tracker.

Use the AGS-2 AI-grind tracker for the detailed file and line references. Start with the shared parent and root pom, then inspect the launcher scripts and existing surefire settings for the required Java 21 configuration, Maven enforcement, wrapper, Lombok, and runtime flags. Run the main module build and its 770-test suite on JDK 21; done means all JVM modules use the new baseline and the verified tests still pass.