Add CI (Azure Pipelines + CodeQL) with build/test/coverage, and test-bench fixes needed to get there - #2

Fixes #7. Also documents/references #3, #4, #5 (not fixed by this PR -- see plan/findings.md and the "Known limitation" section below).

Summary

Stacked on #1 (this repo currently has no CI at all and thin test coverage on
both sides of the JNI boundary -- see plan/findings.md, not included in this PR
since it's gitignored). This PR gets a real, green, hang-free CI baseline in place
before the planned Panama/Silk JNI-boundary strangler-fig migration starts.

Test-bench fixes (prerequisite -- the suite couldn't complete before these)

• tools/run_tests.sh/run_tests.bat: fixed a dead CLS_PATH variable that meant
  the JOGL jars were never actually on the classpath -- any OSR-based JUnit test was
  silently unrunnable via the official script.
• TestSetupExtension: added headless-safe CefApp flags (GPU/Vulkan/on-device-model
  disabled) -- without them a GPU-process crash on teardown triggers a multi-minute
  fallback probe on a display-less CI agent.
• TestFrameTest, DisplayHandlerTest: converted from TestFrame's default
  windowed browser mode to OSR. Windowed close never fires onBeforeClose after
  native window disposal -- reproduced in two independent headless environments,
  matches upstream java-cef#364 -- so these tests could not complete in any
  automated environment before this change.
• DisplayHandlerTest: onTitleChange/onAddressChange can legitimately fire more
  than once with the same value; made the assertions idempotent instead of assuming
  exactly one call.
• DragDataTest.createFile(): fixed a wrong assertion --
  CefDragData.getFileNames() returns display names, not paths (confirmed against
  cef_drag_data.h, which has a separate GetFilePaths()).

Result: the full JUnit suite (12 tests) now runs to completion with zero
failures, in both Release and Debug builds, under both a real X server and a
from-scratch Xvfb+window-manager+dbus setup (the combination a real headless CI
agent needs). First time this has ever completed cleanly.

CI (Linux-only for now -- see plan/findings.md for staging rationale)

• .azure/build.yml + templates: Test job (fast) and Coverage job (gcov for
  native/*.cpp + JaCoCo for org.cef.*, uploaded to Codecov). Both cache the
  downloaded CEF binary distribution (~615MB compressed) keyed on CEF_VERSION +
  platform.
• CMakeLists.txt/native/CMakeLists.txt: new ENABLE_COVERAGE option, applies
  --coverage to the jcef target only.
• .github/workflows/codeql.yml: lightweight Java + C++ static analysis.

Coverage crash: mitigated (real numbers now), root cause tracked separately (#4)

CEF's native shutdown reliably crashes in Debug builds (required for gcov) with
DCHECK failed: all_.empty() in browser_context.cc -- reproduced with a single
test class and as few as 2 browser lifecycles, a general Debug-build defect (filed
as #4), not something introduced here. Individual test results are unaffected (crash
is in final process teardown, after every test already passed).

Tried increasing the shutdown message-pump count -- did not help, reverted (no
unproven change kept). What actually works: CoverageTestHelper.{cpp,java} (new,
coverage-only test/CI infra, not part of the public API, only compiled in when
ENABLE_COVERAGE is on) explicitly flushes gcov data via __gcov_dump()
immediately before the known-crashing shutdown call. Verified: 72 .gcda files now
written (zero without this), gcovr produces a real report from them -- 27%
overall, full per-file breakdown. The crash still happens every time; this rescues
the coverage data instead of losing all of it. continueOnError: true on that step
so it doesn't hard-block the pipeline. Root-causing the crash itself is left to a
follow-up branch per #4, not this PR.

Also added

• .azure/scripts/jdk.yml: pin JDK 21 explicitly (found locally that a too-new JDK
  produces bytecode JaCoCo 0.8.12 can't parse -- a real version-skew risk this
  avoids), referenced from every job.
• BuildWindows/BuildMacOS jobs: build-only (native + Java compile, no test
  execution -- none of the hangs/crashes found this session are build-time issues).
  Unverified -- no Windows/macOS machine in this dev environment to run them on.

Test plan

• Full JUnit suite: 12/12 pass, Release build, real X server.
• Full JUnit suite: 12/12 pass, Release build, from-scratch Xvfb+icewm+dbus
  (the real-CI-equivalent setup).
• cmake -DENABLE_COVERAGE=ON configures and builds cleanly.
• Confirmed the Debug/coverage shutdown crash is pre-existing and general, not
  caused by any change in this PR (reproduces with a single test class).
• Actual Azure Pipelines execution -- no Azure account access from this session;
  pipeline YAML is structure-checked against jpype's known-working templates,
  not executed. First real run happens once the pipeline is linked to this fork.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BLqFiEqAPbHc3MifgpNjA8