ci: revive selenium grid as wired nightly track

[jsugg]

What

Adds a Java Selenium Grid track to the Nightly workflow with pinned Hub and browser-node images. The job waits for Grid readiness, runs the Java regression suite with -DuseSeleniumGrid=true, and uploads Surefire XML under the Grid slice. Java docs now explain local Grid parity and cloud-provider placeholders without requiring secrets.

Why

proposal Phase 9 / R18: the old Grid path was decorative because it never activated the remote profile. This makes the advanced/nightly track prove real remote WebDriver execution while keeping provider credentials out of scope.

Verification

• rtk docker run --rm -v "$PWD:/repo:ro" -w /repo rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 -color passed.
• rtk git ls-files -z '*.md' | xargs -0 npx --yes markdownlint-cli2@0.23.0 passed with 0 errors.
• rtk python3 tools/check-scenarios.py --write-matrix && rtk git diff --exit-code docs/scenario-matrix.md passed.
• Local Compose Grid smoke passed through maven:3.9.11-eclipse-temurin-25 with -DuseSeleniumGrid=true: 7 tests, 0 failures, 0 errors, 0 skipped.
• Independent verifier reran the focused gate set and Grid smoke successfully.

Out of scope

Cloud-provider execution, new secrets, branch protection, and remote branch deletion.