release.yml ignores the codeanalyzer-java pin and bundles releases/latest #336

Problem

.github/workflows/release.yml ("Inject the latest Code Analyzer JAR", line 73) downloads the JAR from codeanalyzer-java/releases/latest, ignoring the codeanalyzer-java = "2.4.1" pin in pyproject.toml. The pin is documentation only.

Verified on the published wheels: cldk-2.0.0rc2 bundles both codeanalyzer-2.4.1.jar (checked in) and codeanalyzer-3.0.1.jar (injected). JCodeanalyzer._locate_jar picks sorted(glob)[0] (cldk/analysis/java/codeanalyzer/codeanalyzer.py:93), so 2.4.1 wins by lexical order only. cldk-1.5.0 (2026-07-27, before codeanalyzer-java 3.0.0) bundles 2.4.1 alone.

Consequences today: 35 MB of dead weight in the wheel. Consequence the moment lexical order flips or the checked-in jar is removed: the SDK's v1 Java models silently parse a v2 analysis.json (no extra= policy on the models).

Scope boundary

In scope: make the workflow fetch the pinned version (releases/tags/v<pin>), so the pin is authoritative and a pin/asset mismatch fails the release (the gate deletes the tag).

Out of scope: bumping the pin to 3.0.1 (leg 3, #310); changing _locate_jar; removing the checked-in jar; codeanalyzer-java#177 (retiring the lockstep on the analyzer side).

Goals

• release.yml reads the pin from pyproject.toml and downloads codeanalyzer-<pin>.jar from releases/tags/v<pin>.
• A missing asset for the pinned tag fails the step (no silent fallback to latest).
• The "Verify the codeanalyzer JAR is bundled" step asserts exactly one codeanalyzer-*.jar in the wheel, and that it is the pinned one.

Caveats and known risks

• The workflow only runs on a tag; there is no PR CI. The change is verified by the next -rc cut (rc.3), whose gate deletes the tag on failure.
• Reading the pin with grep/sed assumes the single codeanalyzer-java = "X" line stays in pyproject.toml.

Definition of done

• The next tagged release's wheel contains exactly one codeanalyzer-*.jar, and its version equals the pyproject.toml pin (checked with unzip -l).
• The workflow diff is reviewed; no other steps changed.