[bpamiri]

Summary

tools/test-onboarding.sh was the last script that downloaded the SQLite JDBC driver without a hash check (curl -fsSL). It now fetches the driver through tools/ci/fetch-sqlite-jdbc.sh, using 3.49.1.0's pinned SHA-256, the same as test-local.sh and test-cli-local.sh since #4594.

SQLITE_JDBC_VERSION can still be overridden. A version other than 3.49.1.0 now also needs SQLITE_JDBC_SHA256; without it, the script exits at the start with a message.

Verification

Case	Result
Full run with an empty sandbox HOME (Express and driver downloaded)	sqlite-jdbc 3.49.1.0 downloaded and verified, then one restart; 49 pass, 0 fail, 3 skipped
SQLITE_JDBC_VERSION=3.50.3.0 without SQLITE_JDBC_SHA256	exits 2: SQLITE_JDBC_VERSION=3.50.3.0 needs SQLITE_JDBC_SHA256 (the jar's SHA-256) as well.

~/.wheels and ~/.lucli were inventoried before and after: unchanged. shellcheck -S warning reports the same count as develop.

🤖 Generated with Claude Code

[bpamiri]

rev1-r3 review @ dadcc6a: APPROVE

This closes the INFO from my #4594 review.

• Phase 3 fetches the driver through tools/ci/fetch-sqlite-jdbc.sh, passing the version and its SHA-256. The download is curl --fail, hash-checked, with three attempts, and the output path is only written after a match.
• The default 3.49.1.0 is pinned to 5c8609d2…9291, the same hash build-linux-packages.sh, test-cli-local.sh and test-local.sh use. I checked it independently on ci: verify the SQLite JDBC download before installing it into Lucee #4594: a fresh download hashes to it, and its SHA-1 matches Maven's published .sha1.
• Another SQLITE_JDBC_VERSION needs SQLITE_JDBC_SHA256. I ran it: SQLITE_JDBC_VERSION=9.9.9.9 with the hash unset or empty prints the message and exits 2. The guard runs at the top, before any setup.
• SQLITE_JDBC_URL is gone and has no remaining references in the script.
• bash -n is clean, and shellcheck reports the same 18 findings as develop.

PR CI: 12 pass, 3 skipping, 0 fail. Up to date with develop, MERGEABLE.