CVE-2025-24813: Apache Tomcat partial PUT session deserialization RCE

Goal: hunt for a real runtime security impact in Apache Tomcat on a real Tomcat server/webapp, scoped to apache/tomcat and recent official 2026 advisory classes plus adjacent code. Do not rerun the already confirmed CVE-2026-50229 examples XSS. Prioritize attacker-perspective runtime proof, highest achievable impact, and negative controls against fixed/current versions. Candidate surfaces: security-constraint bypasses including method omission and default servlet behavior; RewriteValve normalization/decoding bypasses including WEB-INF/META-INF exposure and PUT-to-RCE style chains when realistic; WebDAV unauthenticated body handling and DoS/side effects; AJP authentication and secret edge cases; cluster EncryptInterceptor replay/padding/bypass behaviors. Required proof: start a real Tomcat instance or integration harness, configure the relevant feature under realistic preconditions, send real HTTP/AJP/cluster requests, capture server/client logs, write reproduction_steps.sh, runtime_manifest.json, validation_verdict.json, and negative-control evidence. Avoid text-only/static assertions. If no exploitable path exists, produce a runtime-clear verdict with exact exercised surface and blocker.