Play Framework

build: add ant audit-census, the runtime half of the dependency audit

audit-deps answers 'can the framework's bytecode reach this jar', which is
necessary but blunt — 40 of 136 jars are unreachable and nearly all are still
required, because static analysis cannot see JNI natives, a driver named only in
a config string, ServiceLoader bindings, or a module's runtime-compiled app/
tree. This adds the complementary question: was it ever actually loaded.

The suites are driven under -Xlog:class+load and the source jar of every defined
class is tallied. A run observes ~37,700 class loads across the two forks, with
94 of 136 jars supplying at least one class.

Deliberately opt-in and non-failing. 'Never loaded' means these suites did not
exercise it, not that it is dead: they drive H2 rather than PostgreSQL and never
run an end-user application's own tests, so postgresql and junit-jupiter-engine
correctly show zero loads and must still ship. The trustworthy direction is the
positive one — a jar the census loads is proven necessary.

First use, on the three 'unverified' entries: all of dom4j, jandex and cglib went
unloaded in a run where Hibernate fully bootstrapped against H2 — 3,892
hibernate-core classes, 5,035 org.hibernate.* loads, DDL and entity operations,
with ByteBuddy (2,193 classes) performing the enhancement cglib once did. Their
allowlist entries now carry that evidence instead of a guess. They are still not
removed: the suites never load an hbm.xml mapping, never supply a Jandex index,
and framework/lib lands on application classpaths, so dropping one is a decision
about end-user apps rather than a fact the census can settle.

Same refusal-to-mislead guard as audit-deps — if no logs are found, or the
-Xlog format moves so no 'source:' lines parse, it throws rather than reporting
that nothing was loaded. Both paths were exercised, as was the gating: a normal
Buildfile: build.xml does not exist! creates no census/ directory and is unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTvjeSmGVe7RFyx8ZJXRAx