[konlue]

Describe what this PR does / why we need it

Issue #295 reported that the BouncyCastle and Tomcat upgrades in the root pom did not reach the separately published argi-bom, so BOM consumers resolved older versions (bcprov 1.85 vs 1.86, tomcat-embed 11.0.26 vs 11.0.27). On current main the versions themselves are already aligned — this PR delivers the part of the acceptance criteria that keeps them aligned without relying on hand-maintained duplicated properties, and validates the result the way the issue asks for: as a consumer sees it.

What is delivered

tools/scripts/check-bom-consistency.py (standard library only, no new Maven module, per the issue's constraint):

Source-level alignment check (default mode)

Compares the properties of the root pom.xml and argi-bom/pom.xml directly — revision and the five shared security families (jackson-2-bom, jackson-bom, bouncycastle, jsoup, tomcat). Any drift is reported line by line and fails with exit code 1. Because it reads the source poms, it runs on every CI build without requiring a release package or a flattened POM, which the existing verify-release-artifacts.py (release build only, io.github.agentic-ai-java group only) does not cover.

Consumer-level effective-version check (--verify-consumer)

Generates a minimal out-of-repo consumer whose dependencyManagement imports only argi-bom, declares the full managed BouncyCastle family (bcprov/bcpkix/bcutil) and the managed Tomcat embed family (core/el/jasper/websocket) without versions, and resolves them through maven-dependency-plugin:list. The effective versions are asserted to equal what the BOM manages — effective versions as a consumer sees them, not reactor property strings. The BOM keeps plain dependencyManagement entries, so a consumer's explicit override keeps working.

Wiring

• build-and-test.yml: the check-style job gains make bom-consistency-check, so every PR catches "root upgraded, BOM not upgraded"; the build job gains make bom-consumer-verify after the release-artifact verification (installs argi-bom, then runs the consumer check).
• tools/make/java.mk: the two targets above.

Red/green evidence

Green: on this branch the script reports all six shared properties aligned and, with --verify-consumer, all seven managed artifacts resolving to the BOM versions through the out-of-repo consumer. Red: reverting the BOM's bouncycastle.version to 1.85 makes the check fail with DRIFT bouncycastle.version: root pom has 1.86, argi-bom has 1.85 (exit 1); restoring it goes back to green.

Scope note

This covers the core repository, where the BOM lives; consumers of the extensions repository inherit the fix through the same BOM. Cross-repository candidate version selection remains issue #229's scope, and no package names or coordinates change.

Fixes #295

[yuluo-yx]

LGTM