Stability checkpoint — svc 1.0.52 (wave 3 compat fixes + matrix doc refresh + workflow allowlist)

Captures :
- !192 (wave 3) : 4 surgical compat fixes uncovered by 1.0.51 validation
  * SB3 overlay CustomerController PATH_CUSTOMERS field added
  * SecurityConfig.securityFilterChain throws Exception (SB3-compat, no-op SB4)
  * CustomerNewEndpointsITest 6× .getFirst() → .get(0) (J21+ → universal)
  * J17 test overlay AggregationServicePropertyTest + Maven antrun step
- !193 (doc) : COMPATIBILITY_MATRIX.md refresh (waves 1+2+3 results) +
  matrix-results/ added to .gitlab-ci.yml workflow:rules:changes allowlist

Compat matrix on main #2478280759 (this commit) :
  ✅ SB4+J21 (wave 2 IT tag-gate worked)
  ❌ SB3+J17 / SB3+J21 / SB4+J17 — !194 (wave 4 SB3 BOM precedence
     fixes + pre-java25 overlay copy) not yet merged when compat ran.
     Re-trigger expected post-!194 merge for full validation.

See COMPATIBILITY_MATRIX.md for the 4-wave evolution table.