Add releaseAll.sh for combined Central releases

[perNyfelt]

Adds releaseAll.sh to release eligible, unreleased, non-SNAPSHOT Gradle modules, matrix-bom and matrix-all in one signed Maven-layout ZIP and one Central deployment. Existing separate-release scripts remain available.

Production compile dependencies (including compileOnly) participate in eligibility; exclusions cascade, selected BOM pins must match, and already-released pins for unselected modules remain valid. Clean-source manifests guard staging, bundling and upload. Maven verification reuses the portable BOM API/japicmp verifier with immutable staging and a separate repository. External prerequisites run before scoped verification; GSheets preflight remains unpublished.

Depends on the enhancement in Alipsa/nexus-release-plugin#6. Development release commands use the explicit sibling composite; ordinary Matrix builds retain their published plugin version. Publishing the enhanced plugin and switching that version remain a separate release step.

Validation passed locally on macOS:

• Repository-wide CodeNarc (including codenarcAuthPreflight), Spotless, full headless build and full normal tests. The Maven smoke tests used freshly populated isolated artifacts rather than stale user Maven Local snapshots.
• Script syntax/ShellCheck, portable helper/inventory tests, scoped workflow/early-failure/upload-resume acceptance and strict release-task configuration-cache reuse.
• Standalone BOM verification plus real manifest verification of 20 unreleased fixture coordinates with read-only staging, API ITs and japicmp.
• Actual signed Maven preparation with a disposable keyring: BOM installation, staged dependency resolution, flattened aggregate POM, verified GPG signatures, validated bundle and preserved fixture user settings.
• Independent GSheets JavaExec/classpath with explicit Groovy BOM, controlled authentication/HTTP responses, scope/call-site coverage, invalid-signature static-compilation rejection and artifact/POM leakage inspection.
• Actual clean-checkout ./releaseAll.sh --dry-run: empty selection for current SNAPSHOT versions, no tests/signing/staging/upload.

Exact commands and results are recorded in req/releaseAll-plan.md; usage/defaults/recovery are in docs/releaseAll.md. The small matrix-pict test change fixes a pre-existing CodeNarc violation while preserving its JavaFX-absence assertion.

CI checks portable tools on macOS/Linux and both BOM verifier modes on Linux. Live sanitized Portal fixture capture remains pending because publisher credentials are unavailable; absence-based discovery and real uploads fail closed until it is confirmed. Existing Docker-unavailable skips and japicmp compatibility warnings are preserved. No versions, baseline or Git tags were changed and no artifacts were published.

Review fixes address all six findings: missing GSheets authentication import (both external entry points exercised offline), manifest staging beyond BOM pins, read-only symlink canonicalization with strict writable-path guards, lazy inventory classpath resolution, temporary verifier settings, and inherited Java/Groovy nested-class tags/Disabled annotations.

Additional local verification passed:

• GSheets CodeNarc, Spotless and all 161 tests; full ./gradlew test -Pheadless=true --no-configuration-cache --max-workers=3.
• Strict GSheets configuration-cache storage/reuse; guarded offline help proves compileClasspath is not resolved during configuration. Persistent regression included in test-auth-classpath.groovy.
• Portable helper/inventory tests (46 assertions), workflow acceptance and Bash/ShellCheck.
• Standalone BOM verifier and two real manifest verification cases: unpinned matrix-smile; newer selected arff with older unselected BOM pin; immutable staging; API ITs/japicmp; cache inside matrix-bom preserves checked-in settings.
• Isolated authentication classpath/controlled probes/static compilation acceptance.

Exact commands are recorded in plan section 7. CI for these fixes: https://github.com/Alipsa/matrix/actions/runs/37993222681 (queued at update).