chore(ci): fix release-gate java/kotlin (pom drift) + run heavy CI locally to cut Actions cost

[dmealing]

What & why

Two coupled problems, fixed together.

1. release-gate (java|kotlin) was RED on main

Root cause: the reactor-excluded integration-test modules
(server/java/integration-tests, integration-tests-kotlin) pinned their parent to
7.4.4-SNAPSHOT while the reactor moved to 7.5.1-SNAPSHOT. They sit outside the
reactor, so the release mvn versions:set silently skipped them — ../pom.xml then
no longer matched the declared parent, Maven rejected relativePath, fell back to
repos, and the SNAPSHOT was absent → "Non-resolvable parent POM".

Fix: bump both to 7.5.1-SNAPSHOT. Verified locally — scripts/integration-test.sh java and kotlin both BUILD SUCCESS.

Recurrence guard: scripts/check-pom-versions.sh (toolchain-free; just grep) asserts
the excluded modules track the reactor version. Wired into .githooks/pre-push and
scripts/ci-local.sh, and the RELEASING.md bump step now calls it out (use the
tree-wide grep, not versions:set).

2. Heavy CI ran on every push/PR — moved local to cut Actions cost

conformance.yml (5-port matrix + full Java reactor + drift/mutation gates) and
integration-tests.yml (5-port Testcontainers) now run on release tags (v*) +
workflow_dispatch only. The cheap public-repo security gate
(hygiene/leak-scan) still runs on every PR.

New primary correctness gate — run locally before opening/merging a PR:

scripts/ci-local.sh            # full parity: all-port conformance + reactor +
                               # drift/mutation + docker integration suite
scripts/ci-local.sh --quick    # fast TS-centric tier (no other-lang toolchains,
                               # no reactor, no docker)

It SKIPs (loudly) any port whose toolchain is absent. The release tag (v*) still
runs the full matrix before anything publishes — the real gate for published artifacts.

⚠️ Required companion step (admin)

main branch protection currently requires all the checks this PR takes off PR
triggers. A required check that no longer runs sits perpetually pending → PRs can't
merge. Branch protection's required-checks list must be trimmed to what still runs on
PR (leak-scan) in lockstep with this change.

🤖 Generated with Claude Code