Modernize and validate the Maven Central signing and release workflow

Commencez par auditer le POM racine et le comportement hérité de oss-parent, puis comparez les plugins de signature et de publication avec la documentation de publication Maven de Sonatype et la version de référence de Java du projet. Validez les quatre artefacts de release et le WAR de test Jakarta facultatif dans un workflow isolé, sans publication. Le travail est terminé lorsque le contrat consommateur, les attentes en matière de reproductibilité, la gestion des identifiants, les étapes de reprise et le processus de publication contrôlé par les maintainers sont documentés et vérifiés.

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

The root POM still uses org.sonatype.oss:oss-parent:9, Maven GPG Plugin 1.6, and Central Publishing Plugin 0.9.0. Ordinary clean verify and CI success do not validate the signing/publishing lifecycle.

This is release-tooling maintenance, not a request to publish a release or change credentials.

Acceptance criteria

• Audit inherited behavior from oss-parent; replace or remove it only after explicitly preserving required metadata and lifecycle behavior.
• Update and pin signing/publishing tooling to versions validated for the project's chosen Maven/JDK baseline.
• Document noninteractive signing, credential requirements, local validation, staging/review, and recovery from a failed release attempt.
• Validate binaries, sources, Javadocs, POMs, signatures, and checksums in an isolated local/staging workflow that cannot accidentally publish publicly.
• Verify all four artifacts preserve the consumer contract: coordinates, scopes, public APIs, Java baseline, automatic/explicit module names, OSGi metadata, and TLDs.
• Confirm the optional Jakarta test WAR is not unintentionally included in a library release.
• Keep production publication explicitly maintainer-controlled and keep credentials out of logs and PR workflows.
• Document reproducibility expectations, including generated manifest timestamps, and fix controllable nondeterminism where practical.

Reference: Sonatype's Maven publishing documentation.