[berezovskyi]

Repair the local Bugzilla stack while retaining Lyo 2.4, Java 8 production bytecode, Java 21/25 CI and the Java 17 Jetty runtime. The Compose XML mount previously referenced a missing file, the Bullseye backend could no longer install its security packages, and CRLF shell scripts prevented startup from Windows checkouts.

• Correct the Compose mount and image names; build the backend on Bookworm with CA certificates and normalize its entrypoint line endings. Add GHCR builds/publication for both images, restricting writes to the upstream default branch.
• Add a JUnit 6/MockServer test of the real j2bugzilla XML-RPC login, compiling tests for Java 17 separately from production. Exclude transitive JUnit 3 that interfered with test discovery.
• Use SLF4J/Logback in handwritten code and generated user-code regions. Remove stale SLF4J API/provider jars from the OAuth WAR overlay and restore the commented consumer-store diagnostic at DEBUG.
• Pin workflow actions, scope permissions, preserve build (21, temurin, false) and merge-group coverage, lock Newman, wait for HTTP readiness and clean up containers. Fix the Postman homepage path and assert all four response statuses.
• Add concise development/contribution/agent documentation and editor settings. Keep the README Maven/Podman startup commands and release dependencies.

Validation:

• Maven clean verify on Java 21 and 25: passed; one XML-RPC test on each.
• Actionlint and offline pedantic zizmor: passed, zero findings. Compose parsing passed.
• Both Docker images built. Compose startup and all four Postman assertions passed: Bugzilla/adaptor homepages, authenticated catalogue, and HTTP 401 without credentials. SLF4J/Logback output was verified in the deployed adaptor.

Known limitations:

• The existing importer processed 1,000 fixture records with 999 successes; bug 392325 failed in can_enter_product. Generated diagnostics outside preservation guards and duplicate XML API jars remain.
• The existing Newman toolchain, now locked at 6.2.2, reports 19 npm advisories, including one critical. npm proposes a major downgrade to 4.6.1 rather than a compatible fix; no forced downgrade or overrides were applied.
• Podman is unavailable locally; GHCR publication will run after merge. The default branch has been renamed to main; this PR targets main and retains the existing merge queue, branch protection and required check. Workflows now filter on main.