[whg517]

Summary

• Add checksum-pinned Tini and a protected universal process-group supervisor for every supported JDK (8/11/17/21/22/23/24), with bounded TERM/KILL, orphan reaping, preserved exit statuses and ordered projected pre/post hooks.
• Preserve root USER, inherited working directory, Bash CMD/stdin, JAVA_VERSION, public JAVA_HOME and Log4Shell mitigation. Keep helpers outside legacy downstream /kubedoop copies, under /usr/local/libexec/kubedoop-java-devel.
• Fix the existing SDK toolchain selection: select the vendor's canonical java/javac alternatives without replacing their jar/javadoc/javap slave links. The original JDK8 image reproduced missing jar/javadoc/javap; all seven corrected SDKs now compile and package real applications. Retain a JAVA_HOME compatibility alias for newer Temurin layouts.
• Add actual toolchain and lifecycle regressions on all 14 native amd64/arm64 JDK CI legs. Fix this workflow's existing invalid regex-style tag filter. Docker RUN compilation does not execute the image ENTRYPOINT; final product runtime stages retain their own entrypoints.

Local verification

• All seven original JDK images built through the repository's generated linux/amd64 bake graph: passed. No images pushed/published.
• All seven frozen generic image suites: passed (actual root/Bash/stdin/stdout, source-to-image hashes, protected HOME/helpers, projected hook ownership/order/stdin/failure, repeated signals, bounded escalation, process-group draining and orphan reaping).
• All seven actual SDK suites, compiling and running separately as UID1001 and root: passed. Each SDK uses its own offline javac, jar, javadoc and javap; Maven's selected runtime JDK is checked. Executable JARs preserve state through three starts of the same container, TERM/INT/docker stop, JVM143/System.exit42 and shutdown-hook flush before exactly-once post hooks. A conflicting legacy child COPY cannot replace the SDK supervisor.
• Source behavior suites as ordinary user and root, Bash syntax, ShellCheck (documented shared-library exclusions), actionlint and diff hygiene: passed.
• Original downstream ZooKeeper:3.9.3 full 20-module source build: passed, with explicit Maven BUILD SUCCESS/no BUILD FAILURE verification. Its actual foreground JVM lifecycle, znode create and persisted read after same-container restart passed; the SDK supervisor does not leak into the separate final runtime stage.
• Organization Makefile gate has no applicable container targets; it is not a substitute for the source/image acceptance above.

Scope and review

Only java-devel and its own workflow change. No product versions, unrelated worktrees, operator changes, merges or releases. Detached/setsid-escaping applications are outside the foreground process-group contract. Container INT requests graceful TERM from the supervisor.

Functional review checked inherited CMD/USER, actual canonical tool/slave selection, modern JAVA_HOME layout, protected helpers versus downstream COPY, real JAR exit/hook ordering and persistence, source-to-image identity and the native architecture matrix. No outstanding actionable findings after fixes. Framework feedback: this image-side Bash lifecycle belongs in containers, not operator-go; no operator-go defect exposed.

Latest-head native CI, including all nine affected Java product workflows, must become terminal successful before the rollout advances. This local verification report does not claim remote CI success.