Provide a reproducible dev shell with JDK 17 and Maven 3.9.x.
JDK 17 (LTS) is used since JDK 16 (project target) is non-LTS
and unavailable in nixpkgs; it is fully backward-compatible with
--source 16 --target 16. Maven is overridden via overlay to use
the same JDK.
