feat(rules-java): expand language guidance

shared/rules/java/references/safety-and-errors.md

@@ -0,0 +1,11 @@
+# Java Safety and Error Handling
+
+Apply these rules when handling external input, failures, resources, or logs.
+
+* Validate size, range, format, and allowed values before expensive parsing, allocation, or side effects. Keep validation consistent with business and security constraints.
+* Reject null where a value is required, with clear argument or boundary validation. Do not hide invalid state behind default values that change behavior.
+* Use try-with-resources for owned `AutoCloseable` resources. Keep ownership explicit and do not close resources supplied by a caller unless the contract says so.
+* Catch only failures the current layer can handle. Preserve exception causes and useful context; do not swallow failures, catch broadly to continue with partial state, or use exceptions for routine control flow.
+* Preserve interruption and cancellation during error handling. Timeouts and retries need bounds and must not silently turn failure into success.
+* Use structured logs where the project supports them. Never log credentials, tokens, personal data, or unbounded payloads; avoid excessive logging in hot paths.
+* Return safe, consistent error information. Do not disclose protected resource existence or internal details to unauthorized callers.