ci(build): switch CI from JDK 17 to GraalVM JDK 25

[bluestreak01]

Summary

Bumps the JDK used across all CI jobs from Temurin JDK 17 to Oracle GraalVM JDK 25 (latest). The Java source/target level (<javac.target>11</javac.target>) is unchanged — only the build/test toolchain moves.

Files changed

• ci/setup.yaml — replaces the JavaToolInstaller@0 step with platform-conditional GraalVM 25 download steps for Linux, macOS (x64 + arm64) and Windows. Sets JAVA_HOME via ##vso[task.setvariable] and prepends bin to PATH, so existing Maven@3 steps using jdkVersionOption: "default" pick it up.
• ci/run_tests_pipeline.yaml — the Javadoc validation job now consumes the setup.yaml template instead of inlining its own JavaToolInstaller. Added jdkArch/imageName job variables so the template's conditions resolve.
• .github/workflows/rebuild_native_libs.yml — both Linux native-build jobs (x86_64 manylinux2014, aarch64 manylinux_2_28) now fetch GraalVM 25 for jni.h. The Windows cross-compile job also installs GraalVM 25 and now pulls Windows-specific jni_md.h from openjdk/jdk25u. The macOS native-build jobs were left alone — they never installed a JDK explicitly and rely on the runner's pre-installed one.

Notes / trade-offs

• URLs use Oracle's …/graalvm/25/latest/… pattern, which is mutable. If you'd prefer reproducible pins, swap in versioned URLs like https://download.oracle.com/graalvm/25/archive/graalvm-jdk-25.0.x_<os>-<arch>_bin.<ext>.
• Oracle GraalVM ships under the GFTC license (free for production use). If GraalVM CE (GPLv2+CPE) is preferred, the URL pattern changes to the graalvm/graalvm-ce-builds GitHub releases.
• manylinux2014 (CentOS 7 / glibc 2.17) is older than what Oracle GraalVM 25 binaries officially target. This workflow only reads include/jni.h from the tarball — it never executes Java — so extraction is what matters and that works regardless of glibc.

Test plan

• Azure Pipelines BuildAndTest stage passes on linux-x64, mac-aarch64, mac-x64, windows-msvc-2022-x64
• Azure Pipelines Validate (Javadoc) job passes
• Azure Pipelines Coverage stage passes
• Manually trigger rebuild_native_libs.yml on this branch and confirm linux-x86_64, linux-aarch64 and windows cross-compile jobs all build successfully

🤖 Generated with Claude Code