QA Changelog 1.0.1

Split the single sequential gradlew build into two parallel jobs on the self-hosted rd-runner: verify (unit + MySQL IT + coverage + SpotBugs
JAR) and oracle-it (Oracle IT). Unit + MySQL IT provide full JaCoCo coverage, so the 90/85 gate and SpotBugs HIGH stay on verify; Oracle IT is a DB-compatibility check and runs off the critical path.

This cuts build wall-clock (previously ~12-15 min) by overlapping the Oracle suite and by reusing the runner’s persistent Docker image cache instead of re-pulling the ~2 GB Oracle image each run. The Docker publish still waits for both suites, so a green full run precedes every dev image.

Also bump actions/checkout to v7 in the callable build workflow.

Fix the shared-dto pin 0.0.14 → 0.0.16: the code imports classes (ProductClassGroupCacheDto, configsdto.*, api.auth.ClientType) absent from the published 0.0.14. Local builds compiled only because a rebuilt 0.0.14 shadowed the registry via mavenLocal; a clean CI checkout failed to compile. 0.0.16 is published with all required classes.

Bump Spring Boot 4.0.3 → 4.1.0 and update libraries to latest stable: ojdbc11 23.26.2.0.0, jaxb-runtime 4.0.9, springdoc 3.0.3, swagger-annotations-jakarta 2.2.52, hazelcast 5.7.0, caffeine 3.2.4, testcontainers 2.0.5, archunit 1.4.2, jqwik 1.10.1, xmlunit-assertj3 2.12.0, mockwebserver 5.4.0, ft-cache 0.0.9, spotbugs 4.10.2.

Verified: compile, unit tests, and SpotBugs pass. Integration suites (MySQL/Oracle) are run separately.

With org.gradle.parallel=true the verify job ran spotbugsMain (effort=max) and the unit test forks concurrently with integrationTestMySql. The CPU starvation dropped the Hazelcast client heartbeat inside the IT Spring context, causing flaky TargetDisconnectedException failures. Order the integration suites after the CPU-heavy tasks so each IT run gets the whole machine; mustRunAfter is a no-op when those tasks are absent from the graph.

UserDeletionUnreachableMailMySqlIT began failing only after CI moved from ubuntu-latest to self-hosted rd-runner. The IT probe hits localhost:25 (JavaMail default), so a local MTA on the runner would flip otpRequired to true. Log the listener state to confirm before fixing. Temporary; revert after triage.