Modernize and validate the Maven Central signing and release workflow

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

The root POM still uses org.sonatype.oss:oss-parent:9, Maven GPG Plugin 1.6, and Central Publishing Plugin 0.9.0. Ordinary clean verify and CI success do not validate the signing/publishing lifecycle.

This is release-tooling maintenance, not a request to publish a release or change credentials.

Acceptance criteria

• Audit inherited behavior from oss-parent; replace or remove it only after explicitly preserving required metadata and lifecycle behavior.
• Update and pin signing/publishing tooling to versions validated for the project's chosen Maven/JDK baseline.
• Document noninteractive signing, credential requirements, local validation, staging/review, and recovery from a failed release attempt.
• Validate binaries, sources, Javadocs, POMs, signatures, and checksums in an isolated local/staging workflow that cannot accidentally publish publicly.
• Verify all four artifacts preserve the consumer contract: coordinates, scopes, public APIs, Java baseline, automatic/explicit module names, OSGi metadata, and TLDs.
• Confirm the optional Jakarta test WAR is not unintentionally included in a library release.
• Keep production publication explicitly maintainer-controlled and keep credentials out of logs and PR workflows.
• Document reproducibility expectations, including generated manifest timestamps, and fix controllable nondeterminism where practical.

Reference: Sonatype's Maven publishing documentation.

Empieza auditando el POM raíz y el comportamiento heredado de oss-parent; después, compara los plugins de firma y publicación con la documentación de publicación de Maven de Sonatype y con la versión base de Java del proyecto. Valida los cuatro artefactos de release y el WAR de prueba opcional de Jakarta en un flujo de trabajo aislado que no publique. Se considera terminado cuando el contrato para los consumidores, las expectativas de reproducibilidad, la gestión de credenciales, los pasos de recuperación y el proceso de publicación controlado por los maintainers estén documentados y verificados.