Run mandatory RC gates with isolated CI failure checks

Local review candidate only. Explicitly selected inherited prerequisites and prior repair patches; unrelated WIP and independent MQ fixes are excluded. No push or deployment authorized.

ci/verify-failure-guard.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+cd "$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
+: "${CI_TEST_DB_URL:?isolated empty MySQL schema URL is required}"
+case "$CI_TEST_DB_URL" in */flowcenter_ci_invalid\?*|*/flowcenter_ci_invalid_*\?*) ;; *) echo 'Negative guard requires its own invalid test schema' >&2; exit 2 ;; esac
+log=$(mktemp /tmp/flow-ci-negative.XXXXXX)
+trap 'rm -f "$log"' EXIT
+set +e
+sh ci/test-gate.sh clean package >"$log" 2>&1
+code=$?
+set -e
+cat "$log"
+echo "NEGATIVE_MVN_EXIT=$code"
+[ "$code" -ne 0 ] || { echo 'Empty schema unexpectedly passed' >&2; exit 1; }
+grep -q 'Schema-validation: missing table' "$log"
+grep -q 'Tests run: 92, Failures: 0, Errors: 11, Skipped: 0' "$log"
+[ -z "$(find target -maxdepth 1 -name '*.jar' -print -quit 2>/dev/null)" ] || { echo 'Failed gate produced a JAR' >&2; exit 1; }
+echo 'CI_EMPTY_SCHEMA_FAILURE_GUARD=PASS'