perf(sandbox): limit javac to the first JIT tier

Keep the short-lived compiler VM on the first JIT tier while preserving student runtime options and every resource budget. The closed profile validator rejects removed or overridden compiler tier options.

Validation: make contracts; make check. Actual isolated VM reacceptance remains pending.

judge/crates/sandbox/src/profiles.rs

@@ -73,6 +73,8 @@ pub fn argv(profile: P, limits: &ResourceLimits) -> Result<Vec<String>, &'static
         P::JavaCompile => {
             let mut args = vec!["/usr/lib/jvm/bin/javac".into()];
             args.extend(jvm_options(limits)?.into_iter().map(|a| format!("-J{a}")));
+            // javac is short-lived; avoid C2 work in the compiler's own JVM.
+            args.push("-J-XX:TieredStopAtLevel=1".into());
             args.extend(
                 [
                     "-proc:none",

judge/crates/sandbox/tests/managed_profiles.rs

@@ -357,6 +357,32 @@ fn startup_heap_and_budget_parameters_cannot_be_supplied_by_request() {
     assert!(small.validate(&SpecPolicy::default()).is_err());
 }
 
+#[test]
+fn javac_jit_tier_is_fixed_without_changing_student_runtime() {
+    let original = request(ExecutionProfile::JavaCompile);
+    let index = original
+        .argv
+        .iter()
+        .position(|arg| arg == "-J-XX:TieredStopAtLevel=1")
+        .unwrap();
+    assert!(original.clone().validate(&SpecPolicy::default()).is_ok());
+    for replacement in [
+        "-J-XX:TieredStopAtLevel=0",
+        "-J-XX:TieredStopAtLevel=4",
+        "-J-XX:-TieredCompilation",
+    ] {
+        let mut changed = original.clone();
+        changed.argv[index] = replacement.into();
+        assert!(changed.validate(&SpecPolicy::default()).is_err());
+    }
+    let mut missing = original;
+    missing.argv.remove(index);
+    assert!(missing.validate(&SpecPolicy::default()).is_err());
+    let run = request(ExecutionProfile::JavaRun);
+    assert!(!run.argv.iter().any(|arg| arg.contains("TieredStopAtLevel")));
+    assert!(run.validate(&SpecPolicy::default()).is_ok());
+}
+
 #[test]
 fn root_image_kind_never_promotes_legacy_authority() {
     let legacy: RuntimeConfig = serde_json::from_str(include_str!(