Modernize and validate the Maven Central signing and release workflow

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

The root POM still uses org.sonatype.oss:oss-parent:9, Maven GPG Plugin 1.6, and Central Publishing Plugin 0.9.0. Ordinary clean verify and CI success do not validate the signing/publishing lifecycle.

This is release-tooling maintenance, not a request to publish a release or change credentials.

Acceptance criteria

• Audit inherited behavior from oss-parent; replace or remove it only after explicitly preserving required metadata and lifecycle behavior.
• Update and pin signing/publishing tooling to versions validated for the project's chosen Maven/JDK baseline.
• Document noninteractive signing, credential requirements, local validation, staging/review, and recovery from a failed release attempt.
• Validate binaries, sources, Javadocs, POMs, signatures, and checksums in an isolated local/staging workflow that cannot accidentally publish publicly.
• Verify all four artifacts preserve the consumer contract: coordinates, scopes, public APIs, Java baseline, automatic/explicit module names, OSGi metadata, and TLDs.
• Confirm the optional Jakarta test WAR is not unintentionally included in a library release.
• Keep production publication explicitly maintainer-controlled and keep credentials out of logs and PR workflows.
• Document reproducibility expectations, including generated manifest timestamps, and fix controllable nondeterminism where practical.

Reference: Sonatype's Maven publishing documentation.

まずルート POM と継承された oss-parent の動作を監査し、次に署名および公開用プラグインを Sonatype の Maven 公開ドキュメントとプロジェクトの Java ベースラインと比較します。4 つのリリース成果物とオプションの Jakarta テスト WAR を、公開を行わない分離されたワークフローで検証します。コンシューマー契約、再現性に関する期待事項、認証情報の取り扱い、復旧手順、maintainer が管理する公開プロセスが文書化され、検証されていれば完了です。