Play Framework

WIP snapshot: third-pass audit fixes + in-progress branch state

Third-pass audit fixes (verified, tested, documented):

* P1 ApplicationCompiler now defaults java.source to 25 (was 17),
  aligning the hot-reload application compiler with the 1.12.x Java 25
  minimum runtime so apps gain Java 21/25 language features without
  needing to set java.source explicitly. Skel application.conf and
  release notes updated with the new default and an upgrade note.

* P1 VirtualThreadScheduledExecutor.scheduleWithFixedDelay now matches
  ScheduledThreadPoolExecutor's contract: when a periodic run throws,
  subsequent executions are suppressed and the returned future reports
  the cause via ExecutionException. Previously the virtual variant
  caught Throwable, logged, and rescheduled forever, so a poisoned
  @Every job would loop indefinitely instead of failing closed.

* P2 VirtualThreadScheduledExecutor.cancel(true) propagates the
  interrupt to the in-flight virtual-thread work via a published
  AtomicReference<Future<?>>. The cancel-after-dispatch race is closed
  on both schedule() (re-check done.isCancelled() right after
  innerRef.set) and scheduleWithFixedDelay() (replay cancel in
  setActiveInner). Previously cancel(true) only cancelled the dispatch
  wrapper, leaving the virtual thread running and producing side
  effects after being reported cancelled.

* New tests (VirtualThreadScheduledExecutorTest) cover failure
  suppression, cancel-interrupt on schedule(), and cancel-interrupt on
  scheduleWithFixedDelay(). Full ant unittest suite green.

Audit findings already addressed by prior commits and re-verified as
non-genuine in the live tree:

* TemplateLoader unique-number atomicity — already uses
  ConcurrentHashMap.computeIfAbsent
* Java#findAllAnnotatedMethods cache key — already uses originalClazz
* Invoker mutable state visibility — already volatile, with
  authoritative state behind ExecutorFacade

One finding reviewed and intentionally left as-is:

* Utils.AlternativeDateFormat synchronized parse() — documented design
  trade-off (single shared instance vs per-VT allocation; JEP 491
  removes pinning). DateTimeFormatter migration is invasive and wants
  benchmarks before swapping.

Also bundles pre-existing uncommitted in-progress work across the
branch (Crypto, F, WS, ActionInvoker, PlayHandler, ServletWrapper,
ApacheMultipartParser, HTTP, Java, JPQL, Job, JobsPlugin,
ApplicationClassloader, FileService, HttpServerPipelineFactory,
TemplateLoader, Utils, Invoker, Play, PlayStatusPlugin, Binder, Http,
ServletWrapper, HTTPTest, AGENTS.md, CLAUDE.md, install.textile,
dependencies.yml) plus new sources (ErrorBindings, ExecutorFacade) and
bundled brotli/netty native jars. These were dirty in the working tree
at session start and are committed here unchanged from that state.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>