Code quality tooling (warnings + static analysis)

[alexgubanow]

Address OpenSSF Best Practices quality-related recommendations:

1. Compiler warnings

• Enable sane compiler warnings for C++ builds (e.g. -Wall -Wextra -Wpedantic)
• Enable Java compiler linting (e.g. -Xlint) via Maven
• Do not require warnings-as-errors unless intentionally chosen

2. Static analysis

• Introduce lightweight static analysis tools:
• Java: SpotBugs / PMD / Checkstyle (choose one)
• C++: cppcheck or clang-tidy (choose one)
• CI integration is optional; best-effort usage is acceptable.

3. Documentation

• Add a short QUALITY.md (or equivalent) documenting:
• enabled compiler warnings
• static analysis tools used
• how to run them locally
• best-effort nature (no SLA guarantees)