Drop obscure features

[wprzytula]

This PR drops obscure, legacy public features of the driver:

1. OSGi support — the jars are no longer bundles: maven-bundle-plugin and its <instructions> are gone from all five modules (<packaging>bundle</packaging> → jar), and the osgi-tests module, the Felix/Pax-Exam dependencies and the OSGi manual page are deleted. Automatic-Module-Name is unaffected — it is set by maven-jar-plugin, so JPMS module names are unchanged for module-path users.
2. The core-shaded module — its purpose was relocating Netty and Jackson away from the application's copies; with the networking layer moving to the Rust core, Netty is on its way out of the driver entirely.
3. GraalVM native-image support — the substitution classes, the org.graalvm dependencies, the manual page, and the META-INF/native-image/** configuration, which would otherwise have kept injecting Args= into downstream native-image builds with nothing left to substitute out. The now-dead .snyk policy (three graal-sdk CVE ignores) goes with it.

I hope no one will miss them.

Review round 3

• Uuids: the lazy-init comment now states JAVA-2663 as the historical reason instead of describing a constraint that no longer exists (three of the four PID sources need no native infrastructure). The holder stays — the laziness is what JAVA-2663 asked for. A separate commit fixes a pre-existing race the reviewer spotted next to it: initialized = true was written before val = makeClockSeqAndNode(), so a second thread could mint time-based UUIDs with clockSeqAndNode = 0 (wrong variant bits, node part shared across hosts) for the tens of milliseconds the first thread spends hashing local addresses — and forever if that call threw.
• The assembly's META-INF/MANIFEST.MF exclude moved into the Drop OSGi support commit, alongside the <archive><manifestFile> removal it belongs with, so no commit leaves guava-shaded with two unpinned manifest contributors. All three commits' assembly descriptors now parse as XML — the first attempt at moving it left the file without its closing </excludes> at one commit, which would not have built.
• ReflectionTest: the thrice-duplicated always-throwing loader is one blindLoader() helper, plus a new case for the LinkageError arm of catch (LinkageError | Exception e) that nothing covered. 8 cases.
• Native: LibcLoader collapses to private static Libc loadLibc() — no class left implying a choice of implementation.
• Dependency's javadoc no longer claims the shade plugin rewrites these package names: core-shaded (which relocated Jackson) is deleted here, and guava-shaded relocates only com.google, which none of the five entries is.

Review round 2

• SessionBuilder.withClassLoader's javadoc no longer promises that a partially-resolving loader is safe in general: reflective class loading retries with the driver's loader, configuration resources do not, so an application.conf the given loader cannot see is silently ignored. The paragraph states that asymmetry instead of narrating what the javadoc used to say.
• guava-shaded: clean-classes is restored (with the rationale that actually applies — dependency:unpack overwrites but never deletes, so a stale entry from a previous Guava version would otherwise reach the published jar on a non-clean build), and the assembly fileSet now excludes META-INF/MANIFEST.MF so maven-archiver is the manifest's single contributor, as the OSGi plugin used to guarantee.
• The upgrade guide records the consequence of dropping java-driver-core-shaded (Netty/Jackson version clashes with the application's own copies, Jackson especially, since config reporting detects it reflectively), and the GraalVM list now names the request-processor substitutions and the Graal dependency checker.
• ReflectionTest grows to 7 cases: the two-loader exhaustion path and the default-packages overload — the branches the deleted OsgiCustomLoadBalancingPolicyIT used to cover — are now pinned, not just the single-loader ones.

Review round 1

All four inline comments and the three anchorless findings are addressed:

• the orphaned native-image configuration is deleted (seven files) and the upgrade guide explains why the config had to go with the classes;
• every OSGi-derived rationale in the surviving sources is rewritten rather than left dangling — SessionBuilder.withClassLoader, DriverConfigLoader, DefaultDriverConfigLoader, DefaultProgrammaticDriverConfigLoaderBuilder, Reflection and DefaultDependencyChecker now state why the driver-loader fallback stays (layered class loaders in web apps and application servers), instead of citing Dynamic-Import:* or Apache Felix;
• three ReflectionTest cases replace the custom-ClassLoader coverage that died with the OSGi tests: the two-step fallback, user-loader-first ordering, and the null return;
• guava-shaded's dead clean-classes execution is dropped, and the sources-jar question is answered below;
• the stale osgi-tests' CustomRetryPolicy reference in DefaultDriverConfigReporterTest is gone, and the historical 4.13.0 upgrade-guide entry no longer links the deleted GraalVM manual page.

Verification

JDK 17, on the rebased branch:

• mvn clean verify -DskipTests — BUILD SUCCESS across the reactor (this is make check: fmt:check, revapi:check, jar manifests, javadoc).
• mvn clean verify -pl guava-shaded — still attaches java-driver-guava-shaded-…-sources.jar (6.9 MB, 668 entries, 655 of them relocated under com/datastax/oss/driver/shaded/guava), so a release would not be rejected for a missing sources jar. maven-source-plugin contributes nothing now that the module has no Java sources; shade's createSourcesJar builds it from the dependencies' sources. The final jar is 2038 entries, 2020 of them under com/datastax/oss/driver/shaded/guava, zero unshaded com/google/, and its manifest is maven-archiver's (Manifest-Version: 1.0).
• mvn test — green except the 20 known Timestamp*CodecTest.should_parse cases, which are parameterized over ZoneId.systemDefault() and so fail on any non-UTC machine and pass in CI. core goes from 3130 to 3137 tests with the new ReflectionTest cases.
• find . -path "*META-INF/native-image*" — empty.

[nikagra]

Reviewed the three commits stacked on #1 (OSGi, core-shaded, GraalVM native-image). The removals are thorough where it counts: no build references left to core-shaded, osgi-tests, maven-bundle-plugin, felix/pax-*/graalapi or <packaging>bundle</packaging>; distribution*, bom and binary-tarball.xml are consistent; the deleted manual/* toctree entries are complete; and the three commits are individually bisect-safe (the OSGi commit fixes core-shaded/pom.xml before the later commit deletes it).

Two things I checked because they looked risky and turned out fine, so you don't have to re-tread them:

• JPMS module names survive the bundle to jar switch. Automatic-Module-Name is set by maven-jar-plugin's <manifestEntries> (core/pom.xml:217), not by bnd's <instructions>, so com.datastax.oss.driver.core is unchanged for module-path users.
• No new formatting failures. None of the four modified Java files has an import orphaned by the deletions, so this PR adds nothing to the fmt:check backlog from #1.

Commenting rather than requesting changes — nothing here breaks the build. The two substantive notes are the same shape: the upgrade guide declares a removal complete while part of it is still shipped or still documented the old way.

Three findings have no line in the diff to hang off:

• .snyk is now dead config. All three ignores are graal-sdk CVEs, and both org.graalvm.sdk:graal-sdk and org.graalvm.nativeimage:svm declarations are gone. It is also referenced only in the workflow's paths-ignore, so nothing in CI reads it.
• DefaultDriverConfigReporterTest.java:574 justifies its anonymous subclass with "a real subclass of it already exists elsewhere in this repo's test code (osgi-tests' CustomRetryPolicy)" — deleted by this PR.
• The description records no verification. For a change that flips five modules from bundle to jar, discontinues a published artifact and drops a reactor module, one recorded mvn verify is what would settle the guava-shaded question below.

Each comment is a one-line TL;DR with the detail folded underneath.

[nikagra]

Re-reviewed at cfd43331b0. All seven round-1 items are addressed — the META-INF/native-image/** configuration, .snyk, the six OSGi-rationale rewrites, the three ReflectionTest cases, clean-classes, the reporter-test comment and the 4.13.0 link. Not approving yet: one Major and three Minors below, all anchored in the diff.

A correction of mine. Round 1 told you to drop clean-classes because its stated rationale was dead. That was right about the rationale and incomplete about the effect — the execution also made target/classes hermetic, and that property went with it. Details in that thread; not a blocker.

Verified clean, so you can skip re-checking these. No surviving osgi/felix/bnd/graal/core-shaded references outside the design docs and the upstream-only changelog. Automatic-Module-Name genuinely survives bundle→jar — I checked real manifests in ~/.m2: core, query-builder, mapper-runtime and test-infra carried it, metrics and guava-shaded never did. GraalDependencyChecker had no remaining callers. distribution*, bom, binary-tarball.xml, the Makefile and the workflows carry no dead references. The deleted OsgiLz4IT/OsgiSnappyIT/OsgiReactiveIT were @Ignored and have live replacements in integration-tests.

[nikagra]

Re-reviewed at 461819e5. All seven round-2 items check out — the META-INF/native-image/** config is gone tree-wide, .snyk and its paths-ignore readers are gone, the OSGi-derived rationales are rewritten, ReflectionTest is at 7 cases including the two-loader-exhaustion and 3-arg overload paths, the assembly META-INF/MANIFEST.MF exclude is in, and clean-classes is restored. No dangling references to any deleted class, module, doc page or managed dependency; no module still declares packaging>bundle; and core keeps its Automatic-Module-Name via maven-jar-plugin. Two Minors and two Nits inline, none blocking.

One more with no line to hang it on: [Minor] 🟡 core/src/main/java/com/datastax/oss/driver/internal/core/util/Dependency.java:32-34 still tells readers these libraries "may be shaded" and that the shade plugin rewrites the literals to com.datastax.oss.driver.shaded.*. That was true of exactly one artifact — java-driver-core-shaded, which relocated Jackson — and this PR deletes it. guava-shaded relocates com.google only, and none of the five entries is a com.google class, so the paragraph now describes a contract no build step implements. Same cleanup as the sibling DefaultDependencyChecker javadoc this PR already fixed.

[wprzytula]

Round 3 addressed at 79d3b1b01. Replies are inline on the four anchored comments; this one answers the anchorless Minor about Dependency.java.

Right, and removed at 64b68e3 (the core-shaded commit, since that artifact was the paragraph's only referent). The javadoc no longer claims anything about shading:

• java-driver-core-shaded relocated Jackson, and it is deleted here;
• guava-shaded relocates com.google only, and none of the five entries (org.xerial.snappy, net.jpountz.lz4, org.reactivestreams, com.fasterxml.jackson, com.codahale.metrics) is a com.google class.

So the contract had no implementer left, exactly as with the sibling DefaultDependencyChecker javadoc. The rest of the class javadoc — what the fully-qualified names are for — stands unchanged.