fix(build): pin javadoc strictness so a -D flag cannot silence it (#205)

[EtaCassiopeia]

Closes #205

Summary

This pins the javadoc strictness configuration so it cannot be overridden via Maven command-line flags. The -Dmaven.javadoc.failOnError=false flag could silently suppress javadoc errors during deployment without any repo-side indication.

Evidence

The hole, reproduced first. Broken {@link} in Rift.java + ./mvnw -Prelease ... -Dmaven.javadoc.failOnError=false → exit 0 (silenced). With the pin → exit 1. Also defeated: -Dmaven.javadoc.skip=true, -Ddoclint=none, -Dmaven.javadoc.skippedModules=....

Prevention, not detection. This is the 4th issue in the chain #197 → #200 → #203 → #205; the first three all added detection. Pinning removes the vector instead.

The sweep now requires the pin, because deleting it reopens the hole WITHOUT introducing any permissive value — the same self-concealing shape as the rest of the chain.

Three escapes found by adversarial review, each confirmed behaviourally before fixing:

1. <configuration combine.self="override"> at PLUGIN level — stripped the pin from the executing entry while the inert pluginManagement copy still showed it; checker exited 0.
2. The same at EXECUTION level — verified fully exploitable: broken javadoc + the -D gave BUILD SUCCESS with 2× reference not found in the log, and the checker printed "confirmed".
3. <phase>none</phase> unbinding attach-javadocs — javadoc never runs, so the pin is never consulted (milder: yields no javadoc jar, loud at deploy rather than silent).

Fixes: entries are tagged executing vs pluginManagement; the pin is required on every executing entry AND every execution's own <configuration>; a new check requires some execution to actually bind the jar goal to a real phase.

Verification: --self-test now covers 31 cases and runs in CI before the sweep. Real 11-module reactor: all pinned=True jar-bound=True. Clean build still succeeds (doclint=all does not promote the repo's existing missing-tag warnings to errors). Both embedded modules confirmed to inherit the pin into their executing entry. ./mvnw validate passes. The #200 canary and #203 sweep both still pass.

Docs

CONTRIBUTING.md gains a "The pin" section and two stale sentences describing these values as defaults were corrected.