Add post-quantum TLS capability test

[yschimke]

Summary

• add a real TLS 1.3 fixture restricted to the X25519MLKEM768 hybrid post-quantum named group
• add a public-API OkHttp capability test that asserts a successful connection to that fixture
• run the capability under a non-gating postQuantumTest task and classify the current unsupported handshake as an expected result
• publish the new result through the existing container workflow and status-page collector

Why

lysine-dev/okhttp#9517 proposes named-group selection on ConnectionSpec. The currently published artifacts do not expose that API, so this test records the observable before-and-after behavior using only APIs users have today. The assertion remains positive; unsupported JDK/OkHttp combinations fail visibly without making the build red, and will turn green unchanged once the capability is available.

The fixture has its own control test proving that it accepts X25519MLKEM768 and rejects classical X25519, preventing an accidental fallback from producing a false positive.

Validation

• go test ./... in test-server
• ./gradlew containers:compileTestKotlin containers:checkPublicApiOnly -PtestJavaVersion=8
• ./gradlew containers:postQuantumTest --dry-run -PtestJavaVersion=21
• python3 -m py_compile site/tools/collect_results.py
• git diff --check

The live Testcontainers task was not run locally because no Docker daemon was available.