Retain and modernize required browser and packaged WAR coverage

[jmanico]

Closes #93. Completes batch 03 in #169 after #174, #168 and #179.

Retain the required browser suite: the new JSP-engine byte checks cannot replace its JavaScript grammar, HTML parser and DOM interpretation assertions. The optional app now uses supported Boot 4.1.1, the coherent Tomcat/Jasper 11.0.26 API set, Testcontainers 2.0.5 and Selenium 4.49.0. Tomcat is deliberately advanced from the BOM's 11.0.24 for September security fixes; Selenium matches the reviewed browser release. Library APIs, Java 8 and older consumer/engine coverage remain unchanged.

• Pin the browser, Ryuk, SSH host-port helper and Docker probe images by reviewed tag plus verified registry index digest; disable discarded recordings and close browser/container resources with explicit cleanup.
• Replace empty startup scaffolding with PackagedWarIT, which starts the executable WAR, renders both packaged JSPs, checks exact encoded cells and JSTL packaging, rejects duplicate Servlet/Pages/EL API JARs, and stops the process on failure. Keep actual DOM and every existing JavaScript context assertion required in CI.
• Remove the unused JSON starter/service mutation scaffold and conflicting API copies. Retain both JSTL API and implementation. Use context-relative links, standards-mode HTML and no unused JSP sessions.
• Document coverage, API boundaries, supported-version/advisory review, image provenance and update procedure in jakarta-test/README.md.

Local validation passed the new packaged-WAR test, both older real engines, focused tag contracts, API/signature checks, version/parity and actionlint. An OSV query of 34 exact packaged third-party coordinates (including provided container JARs) returned no advisories; this excludes OS image packages, build plugins and test-only dependencies. Docker/browser validation remains required in GitHub CI.

At Jim's request, Sol reviewed all batch 02/03 changes. The browser review caught session URL rewriting in the startup assertion; disabling unused JSP sessions fixed it and the packaged WAR test passed. Sol found no remaining actionable findings, including live batch02 security-setting readback. Astra then reviewed the complete batch 02/03 diff through 413177ce3fae1ab295a73c930deba982683d5e12, found no actionable correctness/security findings, and independently passed the 10 policy/parser tests, 15 artifact guards, 34-file parity check and byte-identical reactor JAR comparison inside the WAR. These are AI reviews, not independent maintainer approvals. CI subsequently caught Testcontainers rejecting a tag-plus-digest name during its image compatibility check. Commit d215dc02f275d8cd9914fbaf6dd50cb8197e9446 explicitly declares the existing Selenium image compatible without changing its pin. Astra reviewed that delta with no actionable findings; its final review now covers the complete diff through d215dc02. Full required GitHub checks remain the merge gate.