build: add reproducible lookahead auditing

[fudianchn]

AI disclosure: this change was prepared with AI coding agents, reviewed and revised line by line by me.

What

Add reproducible lookahead auditing, context-bound review evidence and a CI report, with one DBMSDestination cleanup as a worked case.

Depends on #2827 at 68c035bc058d5236ec8d30ca7909816a0a56e091. Its two commits remain unchanged in this branch and appear in the current diff against master. This phase adds only 2700c0546b4347b55aa40e1dc5621cf09cbd6f9b; review the incremental diff.

Why

Reuse evidence while relevant inputs remain unchanged, and flag it for review when they change. This reduces repeated review without silently retaining stale conclusions.

How

1. Run ./gradlew lookaheadAudit -PlookaheadBase=<commit> to calculate fresh JavaCC FIRST/nullable/FOLLOW facts, structural anchors and transitive production dependencies for both versions.
2. Bind investigated decisions to grammar context, production Java/resources/build inputs, analyzer sources and JavaCC JARs. Report changed decisions, dependency roots and reusable or invalidated evidence.
3. Upload the report in CI. Historical findings remain informational; -PlookaheadFailOnFindings=true enables a strict gate. The analyzer uses existing test dependencies and stays outside the library JAR.

Root cause

An unchanged local FIRST set can hide changed callees or FOLLOW context. Java actions, predicates, recovery code, unknown continuations and ambiguous anchors require conservative review. The report does not prove general semantic equivalence or automatically rewrite grammar.

Testing

• Twelve analyzer tests and thirteen cleanup cases cover evidence invalidation, stable anchors, conservative handling, AST fields, EOF consumption, malformed neighbors and EXASOL round trips. The real entry reports 1,256 unchanged sites without new findings; a watched Java edit invalidates evidence, and exact restoration reuses it without changing the record. All 43 ambiguous groups remain unbound.

• Full Gradle checks: 10,429 discovered, 10,404 passed, 25 skipped. Full Maven verify: 10,411 discovered, 10,386 passed, 25 skipped. Both have zero failures/errors; no Maven gates were skipped. Maven excludes HowToUseSample, whose eighteen cases passed under Gradle.

• Project JMH through ssh dev compared perf: skip redundant lookahead simulations in expression dispatch #2827's head with 626548d: unchanged 54-statement corpus, four interleaved windows, 120 samples. Latency changes were +0.27% and -0.97%, with overlapping score confidence intervals and no clear speedup. Deparsed SQL, semantic-field projections and serialized AST bytes matched. This tooling refactor preserves all 996 library class files byte for byte; JMH was not rerun for 2700c05.

• The three targeted PMD 6.55 rules reproduce all thirteen original Codacy findings and pass after refactoring; maximum method NPath is 128 (threshold 200). Expanded PMD 7.17 checks and Codacy on 2700c05 also pass.

Behavior notes

The worked cleanup removes one redundant LOOKAHEAD(3) before TABLE, while retaining ordinary/cloud connection disambiguation. EXA AT conn TABLE remains invalid, but the current token at failure moves from conn to TABLE; the test checks this boundary.

The report step ran successfully on 2700c05 in GitHub Actions and uploaded lookahead-review. The stated tests and corpus do not establish equivalence for every SQL input or runtime configuration.

Verification of the original issue

No issue is linked. This follows the maintainer's request for a systematic cleanup approach, with #2827's head as the second-phase review and validation baseline.