Target JDK 25 LTS instead of JDK 27

maven.compiler.release and the enforcer floor go to 25, and both the
GitHub CI and the Gitea publish workflow use Temurin 25.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G71TQ5jDETVwdUJxGAwaiT

docs/PLAN.md

@@ -9,7 +9,7 @@ encrypt in-process ("built-in") or hand mail to an encrypting relay/gateway.
 | Topic | Decision |
 |---|---|
 | Build | Maven, multi-module |
-| Java | JDK 27 (`maven.compiler.release=27`) |
+| Java | JDK 25 LTS (`maven.compiler.release=25`) |
 | Spring Boot | 4.1.1 (imported as BOM, not as parent, so consumers are not forced onto our parent) |
 | Crypto | PGPainless 2.0.x (on Bouncy Castle 1.84, `OpenPGPCertificate` API) |
 | WKD hashing/URLs | `org.pgpainless:wkd-java` 0.1.3 (`WKDAddress`). Note: there is no `pgpainless-wkd` artifact on Maven Central; `wkd-java` provides the hashing/URL building. Fetching is ours (JDK `HttpClient`) so we control timeouts, size limits, redirects and fallback. |
@@ -173,7 +173,7 @@ Actuator is optional; when the `pgpkeys` endpoint is exposed
 Extension points: `KeyDiscoveryCustomizer` (wraps WKD discovery below the cache) and `SecureMailSenderCustomizer`.
 
 ## Milestones
-1. **Skeleton** — parent POM, modules, CI (GitHub Actions, `mvn verify` on Temurin 27). ✅
+1. **Skeleton** — parent POM, modules, CI (GitHub Actions, `mvn verify` on Temurin 25). ✅
 2. **WKD discovery + cache** — `WkdKeyDiscovery`, `HttpWkdFetcher`, `CachingKeyDiscovery`, static/composite discovery,
    properties + autoconfig for discovery beans. Tests: z-base-32 vector, advanced/direct fallback matrix,
    size limit, no redirects, cache TTLs. ✅