Play Framework

build: add ant resolve target and reconcile lib/ strays (release 1.12.17)

PF-62: replaces the manual "curl from Maven Central + verify SHA-256 +
drop into framework/lib/" flow with an ant resolve target backed by
Ivy and the existing YamlParser/SettingsParser.

- New entry point framework/src/play/deps/FrameworkResolve.java
  drives Ivy directly against framework/dependencies.yml and copies
  resolved artifacts into framework/lib/. Standalone from the
  existing DependenciesManager because that class hard-codes
  application-shape paths (conf/dependencies.yml input,
  application/lib output) and would treat every framework dep as
  "already framework-local, skip" if reused as-is.
- Idempotent: skips copies when destination matches by name and size.
  Stray detection reports jars in lib/ not in the resolved set;
  -Dprune=true deletes them.
- Vendored allowlist (VENDORED_JARS static set) excludes shaded
  jars without canonical Maven coordinates from stray flagging:
  jj-wikitext.jar, jj-textile.jar, jj-simplecaptcha.jar.
- New framework/build.xml target "resolve" wires it up. Depends on
  compile, runs forked Java with framework.path / play.version /
  prune / verbose system properties; defaults set inline so undefined
  props don't pass literal "${prune}" to the JVM.
- CLAUDE.md and AGENTS.md "Build & Test Commands" sections now
  document ant resolve.
- lib/ stays committed; the target updates it in place so PR diffs
  still show jar adds/removes.

PF-63: audited 6 strays surfaced by ant resolve's first run against
the existing lib/. Findings:

- cache-api-1.0.0.jar — KEPT, added "javax.cache -> cache-api 1.0.0"
  to dependencies.yml. Hibernate's JCacheRegionFactory is active at
  runtime (start/stop messages confirmed in the integration testapp's
  application.log) but no source code imports javax.cache.* directly,
  so the dep was undeclared. Latent clone-and-build bug for any
  consumer not already carrying JCache: NoClassDefFoundError at
  Hibernate boot. Fixed.
- commons-collections-3.2.2.jar — DELETED. Zero references to
  org.apache.commons.collections.* across all sources. True orphan.
- jj-imaging.jar — DELETED. Zero references to
  jj.play.ns.com.jhlabs.image.*. True orphan.
- jj-wikitext.jar / jj-textile.jar — KEPT, allowlisted.
  modules/docviewer/.../DocumentationGenerator uses them via
  fully-qualified class names (which is why "import jj.play."
  grep missed it initially) to render the framework's *.textile
  docs. Shaded; no Maven coordinates.
- jj-simplecaptcha.jar — KEPT, allowlisted.
  framework/src/play/libs/Images.java has 9 jj.play.ns.nl.captcha.*
  imports.

Remaining strays after this PR are 4 of 6 netty-codec-native-quic-*
platform jars — Ivy's conflict manager evicts duplicate
org#name;rev entries with different classifiers, so the cross-
platform native quic jars survive in lib/ but appear as strays
during resolution. Documented as out-of-scope in PF-63;
operators must run ant resolve without -Dprune (the default) to
keep them. Future enhancement could walk the YAML's require: list
directly for classifier-bearing entries.

Verification: ant compile clean, full ant unittest BUILD SUCCESSFUL.
ant resolve reports "Resolved 96 artifact(s); 0 copied, 4 stray"
(strays = the 4 known-limitation native-quic jars, all expected).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>