feat(listReservations): lock in from/to ISO-8601 window passthrough (0.2.3)

[amavashev]

Summary

Client-side companion to cycles-protocol-v0.yaml revision 2026-05-21 and cycles-server#160 (which together added from / to ISO-8601 window-filter query params to GET /v1/reservations). Matches the same shape we landed in runcycles/cycles-client-python#66, runcycles/cycles-client-typescript#103, and runcycles/cycles-client-rust#39.

What this PR does

DefaultCyclesClient.listReservations(Map<String, String>) is already permissive — it forwards arbitrary keys to the URL query string. So from / to work over the wire today, no code change. This PR:

• Adds a regression test on DefaultCyclesClient.listReservations (cycles-client-java-spring/src/test/java/.../DefaultCyclesClientTest.java) confirming the new ISO-8601 params land in the GET path. Pins the contract so future tightening of the Map signature cannot silently drop the new keys.
• Bumps revision from 0.2.2 → 0.2.3 via the single .mvn/maven.config source of truth (propagates to both cycles-client-java-spring and cycles-demo-client-java-spring poms — the drift-protection invariant from the CI-friendly-versions refactor in [Unreleased]).
• Updates AUDIT.md and CHANGELOG.md.

Wire-format note

Spring's WebClient leaves colons unencoded in the query component (RFC 3986 §3.4 permits this), so the emitted path is:

/v1/reservations?from=2026-05-21T00:00:00Z&to=2026-05-22T00:00:00Z&tenant=acme

— not the percent-escaped form. cycles-server accepts both shapes; the test asserts the literal WebClient output.

Call-site syntax

client.listReservations(Map.of(
    "tenant", "acme",
    "from",   "2026-05-21T00:00:00Z",
    "to",     "2026-05-22T00:00:00Z"
));

No reserved-keyword issue (unlike Python where from requires a dict-unpack workaround).

Verification

• mvn -B verify --file cycles-client-java-spring/pom.xml: 433 tests pass.
• JaCoCo coverage gate met ([INFO] All coverage checks have been met.) per the project's ≥95% rule.

Test plan

• CI green
• (After merge) optional smoke against a v0.1.25.20 cycles-server with a windowed listReservations call

Out of scope

• The client's permissive Map<String, String> signature is left as-is; a typed ListReservationsParams would be a separate ergonomic discussion (parallel to the Rust client's existing strongly-typed pattern).

Closes the Spring Boot starter side of the issue cluster for runcycles/cycles-server#159.