Stability checkpoint stable-v1.0.29 (svc) — Phase 4.2 wave continued: 5 JwtAuthenticationFilter tests for the 3-strategy external JWT decoder (Keycloak realm_access roles, Auth0 namespace claim, Auth0-no-RBAC fallback), invalid signature path, and strategy-precedence (realm_access > Auth0 namespace). Filter is now 12/12 covered across both built-in + external auth paths. Cumulative svc Phase 4.2: 242 tests across 27 test files. Post-merge main pipeline #716 SUCCESS.