Replace the older official bootstrap with the checksum-verified8.7 JAR, keeping the configured distribution version and hash unchanged. Record upstream provenance and the distinction from a complete binary audit. Co-Authored-By: OpenAI GPT-6.1 (Codex) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>