[jnbdz]

Builds plan 3 of the quarkus-seo extension, from docs/design/plans/2026-11-08-quarkus-seo-hardening.md and the spec at docs/design/specs/2026-10-29-quarkus-seo-design.md. The spec had no features left, so this plan hardens the extension for 0.1.0 and closes the open items from #2.

Based on seo-opt-in (#2). Rebase onto master once #1 and #2 merge.

What it changes

• schema.JsonWriter is package-private again. The runtime has its own Json helper with the same escaping, and a parity test keeps the two in step. PublicApiTest now also checks the schema package: exactly 6 public types.
• U+2028 and U+2029 are escaped as 
 and 
 in JSON output.
• IndexNow closes its HttpClient on shutdown and does not wait for a slow endpoint. A submit after shutdown completes normally. A ping sent during shutdown can be lost.
• Image values merge as one group. Setting image replaces the image, width, height and alt together. Setting only alt or size keeps the image from the layer below.
• The sitemap prefix reads the path key of the active REST stack only: quarkus.rest.path for Quarkus REST, quarkus.resteasy.path for RESTEasy Classic. A leftover key from the other stack is ignored.
• SeoPaths holds the fixed paths, including the IndexNow key path, so they are no longer duplicated across classes.
• Under a non-/ root path: new tests cover security.txt, llms.txt and the IndexNow key file.
• Dev UI log set: browsed pages are capped at 10,000 and recorded paths at 1,000. Sitemap checks no longer push browsed pages out. A page or sitemap check marks every page it fetches as logged until the next live reload.
• Docs: covers the sitemap self link, the Dev UI log rule and the REST path key per stack. The spec is marked implemented for plans 1 to 3.

Tests

mvn verify passes: runtime 172, deployment 130 and integration 15 tests, and the packaged-app IT passes 13 of 13. On the last native run, the native IT passed 13 of 13 in a Mandrel 25 container build.

Open questions

• The Dev UI components have not been checked in a browser yet.

Known minor gaps

• The RESTEasy Classic detection has no integration test, because a test app using Classic would clash with Quarkus REST. The key selection is unit-tested.
• docs/modules/ROOT/pages/sitemap.adoc line 102 is over 120 columns. It was already like that before this PR.