[velo]

Summary

Adds feign-jdk-json, a codec for the JDK's built-in Simple JSON API (jdk.incubator.json, JEP 540, InfoQ), proposed to target JDK 28. It also fixes the Dependabot auto-merge job, which currently fails on every Dependabot PR.

New module: jdk-json

• JdkJsonDecoder decodes into JsonValue or any subtype (JsonObject, JsonArray, ...), or into the raw String. The JDK API has no data binding, so the codec works on the JSON tree.
  • Malformed JSON, including duplicate member names, throws DecodeException caused by JsonParseException.
  • A JSON type that doesn't match the method's return type throws DecodeException.
  • 404, 204 and empty bodies decode to null.
• JdkJsonEncoder writes any JsonValue as compact JSON.
• Compiled, tested and javadoc'd on a JDK 28 toolchain with --add-modules jdk.incubator.json. A type-mismatch error names the JSON kind it got (e.g. a JSON array) instead of echoing the response body. Moditect is skipped because it can't handle the incubator module.

Build wiring

• The module lives in a new jdk28-modules profile, so contributors without a JDK 28 toolchain can still build the default reactor.
• CircleCI extracts JDK 28 EA from openjdk:28-ea-jdk, pinned by digest in .circleci/jdk28/Dockerfile. SDKMAN returns 404 for the 28 EA candidate. A new docker entry in dependabot.yml lets Dependabot bump the digest when a new EA build ships. The JDK is cached under its own key (the Dockerfile checksum) in ~/jdk28, so a digest bump refetches only the JDK and leaves the Maven/SDKMAN cache alone. CI also adds a toolchain entry for version 28 and runs verify, go-offline and deploy with -Pjdk28-modules.
• The module is added to the BOM and to root dependencyManagement.

Build fix

auto-merge-dependabot.yml ran gh pr merge --auto --merge, but the repository now only allows squash merges. The job failed with Merge method merge commits are not allowed on this repository on every Dependabot PR (#3614–#3619). It now uses --squash.

Caveats

• Incubator APIs can change between JDK builds and releases.

Test plan

• ./mvnw -Pjdk28-modules verify with a JDK 28 EA toolchain: BUILD SUCCESS. JdkJsonCodecTest has 14 tests and all pass.
• ./mvnw -Prelease,jdk28-modules -pl jdk-json -DskipTests package builds the javadoc jar.
• CircleCI green