Flink 1.18: per-line build profile, artifact coordinates and loader identity

[Flanderzz]

Per-line build identity is shipped

PR #198 adds the Flink 1.18.1/Java 17 profile, matching released Calcite/Kafka/protobuf dependencies, compatibility source selection and line-qualified artifacts while preserving the default 2.2 coordinates. Maven enforcement rejects a Flink dependency from the wrong line. Qualified packaging, consumer POMs, source/Javadoc attachments, archive contents and all packaged-loader identity checks are validated.

PR #191 supplied the identity prerequisite; #200 completes image startup enforcement for mixed loader/core/extension payloads, including renamed JARs. The optimized Linux image suite passes on both lines. Both #198 and #200 passed all 47 checks before merge.

This completes the build/identity scope. Production readiness remains tracked by #182, cross-line upgrades by #188 and automated dual-line publishing by #189. The 1.18 line remains experimental. See docs/deployment.md and docs/releasing.md for the current contract.

[Flanderzz]

Payload identity shipped ahead of this issue in #191 (d25f85b2): manifest module and line markers, startup validation of the embedded core plus installed modules, renamed-extension recognition, and bin/check-artifacts.sh verification. That scope is complete and is not repeated here.

Remaining scope for this issue is the build line itself: the flink-1.18 profile, line-qualified coordinates across every deployable module, per-line source roots, per-line admitted planner ABI versions, the dependency-convergence rule, and the packaging, image and CI plumbing that consumes them.

One correction #191 needs: PlannerModule hardcoded its admitted planner versions, so a build for any non-default line refused the planner it was compiled against, and the loader tests named 2.2 and 1.18 literally rather than deriving them. Both are fixed alongside the profile work, with the admitted set moved beside the other per-line sources and the tests reading the target line from the resource payload identity already owns.

[Flanderzz]

The per-line build is on main. Payload identity shipped in #191 and the release line itself in #198, with the official-image payload fix in #204 and the logging provider correction in #203.

The Flink line is now one profile selecting dependencies, compatibility source roots, module coordinates and loader admission together. Each deployable artifact carries a line-qualified coordinate and a manifest recording its module and line; the loader verifies the embedded core and every installed extension before any implementation class loads, so a renamed JAR cannot bypass the check and a mixed install is an error rather than a runtime surprise. Dependency enforcement rejects any other Flink line at validate time.

Verified on c90f5a89:

• mvn -Pflink-1.18 -pl streamfusion-core dependency:tree resolves entirely to 1.18.1 plus flink-connector-kafka:3.2.0-1.18, with zero off-line Flink artifacts.
• mvn -Pflink-1.18 -pl streamfusion-core compile succeeds with zero diagnostics, down from the 99 across 21 files measured when this issue was filed.
• mvn -Pflink-1.18,universal -pl streamfusion-loader -am test passes 12 tests, including both mixed-payload rejection directions, renamed and unmarked extensions, and a real TableEnvironment executing SQL through the installed planner.
• The default 2.2 line builds and tests unchanged.

Documentation is at docs/flink-compatibility.md, which records the per-line dependency table, the module-selection ergonomics under the profile, and the mixed-install rule.

One note for anyone reading the original checklist: admitted planner versions are selected at runtime from the recorded line rather than compiled per line, so there is a single loader implementation rather than a per-line source. That is the same fail-closed guarantee reached a simpler way.

Complete.