[xborder]

Why

The native JarBuild run failed before Maven goals after the hosted runner moved to Maven 3.10.0. The unchanged Arrow 19 Develocity setup reproduces that failure.

What changed

• Pin checksum-verified Maven 3.9.16 in Binaries and Verify.
• Print the selected Java and Maven versions before both builds.

Scope

Necessary CI prerequisite for BDX-1590. Only the existing workflow changes. Arrow sources, dependencies, build checks and downstream publication guards stay intact.

Blast Radius

Both Maven consumers use the validated toolchain. The download fails closed on HTTP or checksum failure. The existing successful-workflow prerelease upload remains active.

Verification

• Independent source and artifact review passes at 942712e40ada4bf454ca48ee6a7f80f7c3bf5d65, with exactly 22 added workflow lines and all prior parsed fields preserved.
• Fresh controlled Maven 3.10.0 fails before goals. Maven 3.9.16 passes startup, inherited nested Verify configuration and all 77 validation goals across 26 modules.
• Actual setup, PATH selection and deliberate checksum rejection pass. Evidence is under workstreams/BDX-1590/ci-review-942712e40ada/ in the Flight SQL through M2 run.

Base is PR33 at 2077c8a5abf15c4da0a6c2fb8baa283f614e4cd6. A fresh native run is required. The failed hosted tool versions are inferred from the exact runner manifest. Hosted JDK, native release, publisher/Dremio consumption and DaaS remain unverified.