[Lotus015]

Fixes #219

Summary

The issue lists three options. This PR does the second one: find the missing toolchain up front and tell the user before any story runs. The other two options (one shared toolchain for the run, or leaving it to the host) stay open as a product decision; see Not in this PR.

• New jvmToolchainGap(cwd, probe) in src/verification/jvm-commands.ts. It uses the same checks as detectJvmCommands / resolveJvmBuildTool: does java -version run (honouring JAVA_HOME), and does the wrapper or the build tool on PATH resolve. If the run verifier would skip mvn test and/or gradle test, it returns one line saying why; otherwise it returns null. It never starts a JDK probe in a repository that is not a Maven/Gradle build.
• orchestrate.ts calls it on the integration root right after dependency materialization, before any story is spawned. A gap is written to stderr as warn: … and, under the TUI, sent as a plan-lane warn activity, so it shows as a note in the session feed.
• Example: no JDK runs on this host (java -versionfailed), so the run verifier will skipmvn test. Install the toolchain on the host (or set JAVA_HOME / commit the build wrapper) for the merged result to be test-verified.
• The verifier itself is unchanged: such a run still ends "not verified", as it has since 0.118.3. The user now hears this at the start of the run, not only at the end.

Not in this PR

• Sharing one scratch toolchain across the run's stories and the verifier, instead of one download per story. This needs a product decision first: should baro download JDKs or Maven at all, and where should they live, given that shell containment only allows writes under the worktree? It would also need env plumbing (JAVA_HOME/PATH) into the story shells and into verifyBuild.
• Telling stories that the host has no toolchain, so they stop downloading one each.
• A repository that gets its pom.xml / build.gradle only from a story (a from-scratch Java project) is not caught up front. The check only sees build files that are in the tree when the run starts.

Test plan

• New jvmToolchainGap (#219) tests in test/verification/jvm-commands.test.ts: no JDK (with and without JAVA_HOME) names both gates; with a JDK, only the build that does not resolve is named; no output and no JDK probe for non-JVM repositories; no output when every gate resolves.
• node --import tsx --import ./test/env.ts --test test/verification/jvm-commands.test.ts: 11/11 pass.
• npm run typecheck -w @baro/orchestrator, npm run build -w @baro/orchestrator, npm run build -w baro-ai all succeed.
• test/verification/*.test.ts plus the orchestrate-* / orchestration-run-id tests: 263/268 pass. Four of the five failures (command-timing ×2, continuous-gate-runner, verify-retry-classification) also fail with this PR's src reverted to origin/main on the same host, so they are pre-existing or environmental. The fifth (verify.test.ts process-tree drain, "fixture did not create … descendant-started") was not re-checked; it was a timing fixture running under load average ~40.
• The full npm test did not finish: the first run was interrupted, the second was stopped while the host was heavily loaded. CI or a reviewer should run it.
• Manual check: start a run in a Maven repo on a host without a JDK and confirm the warning appears in the session feed before the first story starts.

Generated with Devin