Modernize and validate the Maven Central signing and release workflow

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

The root POM still uses org.sonatype.oss:oss-parent:9, Maven GPG Plugin 1.6, and Central Publishing Plugin 0.9.0. Ordinary clean verify and CI success do not validate the signing/publishing lifecycle.

This is release-tooling maintenance, not a request to publish a release or change credentials.

Acceptance criteria

• Audit inherited behavior from oss-parent; replace or remove it only after explicitly preserving required metadata and lifecycle behavior.
• Update and pin signing/publishing tooling to versions validated for the project's chosen Maven/JDK baseline.
• Document noninteractive signing, credential requirements, local validation, staging/review, and recovery from a failed release attempt.
• Validate binaries, sources, Javadocs, POMs, signatures, and checksums in an isolated local/staging workflow that cannot accidentally publish publicly.
• Verify all four artifacts preserve the consumer contract: coordinates, scopes, public APIs, Java baseline, automatic/explicit module names, OSGi metadata, and TLDs.
• Confirm the optional Jakarta test WAR is not unintentionally included in a library release.
• Keep production publication explicitly maintainer-controlled and keep credentials out of logs and PR workflows.
• Document reproducibility expectations, including generated manifest timestamps, and fix controllable nondeterminism where practical.

Reference: Sonatype's Maven publishing documentation.

Start by auditing the root POM and the inherited oss-parent behavior, then compare the signing and publishing plugins with Sonatype's Maven publishing documentation and the project's Java baseline. Validate the four release artifacts and optional Jakarta test WAR in an isolated, non-publishing workflow. Done means the consumer contract, reproducibility expectations, credentials handling, recovery steps, and maintainer-controlled publication process are documented and verified.