* ci: use shared orb pipelines and source scanning Co-Authored-By: Codex <noreply@openai.com> * fix: use released QQQ BOM on main Replace unavailable 0.40.0-SNAPSHOT with the matching 0.40.0 release. Validated with Maven 3.9.11 clean verify: 18 tests passed. Co-Authored-By: Codex <noreply@openai.com> --------- Co-authored-by: Codex <noreply@openai.com>