Modernize and validate the Maven Central signing and release workflow

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

The root POM still uses org.sonatype.oss:oss-parent:9, Maven GPG Plugin 1.6, and Central Publishing Plugin 0.9.0. Ordinary clean verify and CI success do not validate the signing/publishing lifecycle.

This is release-tooling maintenance, not a request to publish a release or change credentials.

Acceptance criteria

• Audit inherited behavior from oss-parent; replace or remove it only after explicitly preserving required metadata and lifecycle behavior.
• Update and pin signing/publishing tooling to versions validated for the project's chosen Maven/JDK baseline.
• Document noninteractive signing, credential requirements, local validation, staging/review, and recovery from a failed release attempt.
• Validate binaries, sources, Javadocs, POMs, signatures, and checksums in an isolated local/staging workflow that cannot accidentally publish publicly.
• Verify all four artifacts preserve the consumer contract: coordinates, scopes, public APIs, Java baseline, automatic/explicit module names, OSGi metadata, and TLDs.
• Confirm the optional Jakarta test WAR is not unintentionally included in a library release.
• Keep production publication explicitly maintainer-controlled and keep credentials out of logs and PR workflows.
• Document reproducibility expectations, including generated manifest timestamps, and fix controllable nondeterminism where practical.

Reference: Sonatype's Maven publishing documentation.

首先审查根 POM 和继承的 oss-parent 行为，然后将签名和发布插件与 Sonatype 的 Maven 发布文档以及项目的 Java 基线进行比较。在隔离的、不执行发布的工作流中验证四个 release 构件和可选的 Jakarta 测试 WAR。完成的标准是：consumer contract、可复现性要求、凭据处理、恢复步骤以及由 maintainer 控制的发布流程都已记录并验证。