feat(java-client): CLI-15 ReplayGap surface + CLI-04 typed-command parity (5/5 complete)

Completes both findings across all five clients — done locally on the Mac now
that homebrew openjdk@17 is available (JAVA_HOME=/opt/homebrew/opt/openjdk@17).

CLI-15: new MxEventStreamItem record + MxEventStream.nextItem() surfaces the
gateway's ReplayGap sentinel as a typed, non-terminal signal (isReplayGap()/
replayGap()/event()); existing Iterator<MxEvent> path unchanged, sentinel never
swallowed/synthesized. Javadoc covers gap semantics + resume contract.

CLI-04: typed single-item helpers on MxGatewaySession — Phase 1
adviseSupervisory/writeSecured/writeSecured2/authenticateUser/archestrAUserToId,
Phase 2 addBufferedItem/setBufferedUpdateInterval/suspend/activate (unregister
already present). Each routes through invokeCommand -> ensureProtocolSuccess +
ensureMxAccessSuccess (same validation as bulk). MXAccess parity preserved.
Credentials flow only into the request proto; exceptions carry only the reply and
gRPC status text is scrubbed via MxGatewaySecrets.redactCredentials — tests
assert the password/secured value is absent from getMessage()/toString()/CLI
output. New CLI subcommands write-secured/authenticate-user (credential via
--password/--password-env, prints only the user id).

gradle test: 106 tests, 0 failures (58 client + 48 cli); no generated churn.
Shared docs: ClientLibrariesDesign + CLAUDE.md updated to "all five clients".

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

docs/ClientLibrariesDesign.md

@@ -83,8 +83,9 @@ discard cached state, re-snapshot, and resume with
 `after_worker_sequence = oldest_available_sequence - 1`. The per-language
 surface follows each idiom (.NET `MxEventStreamItem.IsReplayGap` via
 `StreamEventItemsAsync`; Go `EventResult.ReplayGap`/`IsReplayGap()`; Rust
-`EventItem::ReplayGap`; Python yields a typed `ReplayGap` from
-`stream_events`; Java — pending, tracked with the JDK-17/windows client pass).
+`EventItem::ReplayGap`; Python yields a typed `ReplayGap` from `stream_events`;
+Java `MxEventStreamItem.isReplayGap()` via `MxEventStream.nextItem()`). Shipped
+in all five clients.
 
 ## Public Client Concepts
 
@@ -124,8 +125,7 @@ reach logs, exception text, or `ToString`/`Debug`/`Display` — the value is car
 only on the wire. Each client's test suite asserts a distinctive credential is
 absent from any surfaced error.
 
-Shipped for .NET / Go / Rust / Python; the Java client's typed parity helpers are
-batched to the windows build host (no local JRE on the primary dev box).
+Shipped in all five clients (.NET / Go / Rust / Python / Java).
 
 ## Shared API Shape