chore: migrate PaperHotReloader to Maven and HauntedPlatform

.github/CODEOWNERS

@@ -1,2 +1 @@
-# Default ownership for repository review requests.
-* @HauntedMC
+* @remdui

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -63,7 +63,7 @@ body:
     id: paper_version
     attributes:
       label: Paper Version and Build
-      placeholder: 26.2 build 65
+      placeholder: 26.2 build 129
     validations:
       required: true
   - type: input

.github/dependabot.yml

@@ -1,19 +1,16 @@
 version: 2
+# Platform-owned Maven versions are updated by HauntedPlatform's reviewed reconciler.
 updates:
-  - package-ecosystem: "gradle"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 10
-    labels:
-      - "dependencies"
-      - "java"
-
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+      time: "06:15"
+      timezone: "Europe/Amsterdam"
     open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "ci"
+    groups:
+      routine-action-updates:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    labels: ["dependencies", "ci"]

.github/pull_request_template.md

@@ -1,23 +1,13 @@
-## What Changed
+## Change
 
-Describe the change in a few sentences.
-
-## Why
-
-Why is this needed?
+Describe the behavior or tooling change, why it is needed, and any operator impact.
 
 ## Validation
 
-- [ ] `./gradlew test` (or explain why skipped)
-- [ ] `./gradlew acceptanceTest` for lifecycle, command, or watcher changes
-- [ ] Documentation updated when operator behavior changed
-
-## Related Issues
-
-List related issues (example: `Closes #123`).
+- [ ] `./mvnw -B -ntp verify`
+- [ ] `./mvnw -B -ntp -Pplatform-acceptance verify` for runtime, packaging, or dependency changes
+- [ ] `bash scripts/verify-artifact.sh` for packaging changes
 
-## Notes
+## Compatibility
 
-- Breaking changes:
-- Config/API changes:
-- Anything reviewers should pay extra attention to:
+Document configuration, command, API, and packaging changes, or state that there are none.

.github/workflows/ci.yml

@@ -0,0 +1,127 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  tests:
+    name: Maven tests and artifact audit
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      PACKAGES_USER: ${{ secrets.HAUNTEDMC_PACKAGES_USERNAME || github.actor }}
+      PACKAGES_TOKEN: ${{ secrets.HAUNTEDMC_PACKAGES_TOKEN || github.token }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+          server-id: github
+          server-username: PACKAGES_USER
+          server-password: PACKAGES_TOKEN
+      - run: ./mvnw -U -B -ntp verify
+      - run: bash scripts/verify-artifact.sh
+      - name: Upload test and coverage reports
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-and-coverage-reports
+          if-no-files-found: warn
+          path: |
+            target/surefire-reports
+            target/site/jacoco
+
+  platform-acceptance:
+    name: Paper platform acceptance
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      PACKAGES_USER: ${{ secrets.HAUNTEDMC_PACKAGES_USERNAME || github.actor }}
+      PACKAGES_TOKEN: ${{ secrets.HAUNTEDMC_PACKAGES_TOKEN || github.token }}
+      PHR_ACCEPTANCE_KEEP_WORK_DIRECTORY: 'true'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+          server-id: github
+          server-username: PACKAGES_USER
+          server-password: PACKAGES_TOKEN
+      - name: Run platform acceptance
+        env:
+          PHR_ACCEPTANCE_WORK_DIRECTORY: ${{ runner.temp }}/paperhotreloader-acceptance
+        run: ./mvnw -U -B -ntp -Pplatform-acceptance verify
+      - name: Upload acceptance logs
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: platform-acceptance-logs
+          if-no-files-found: warn
+          path: ${{ runner.temp }}/paperhotreloader-acceptance/paper/paper.log
+
+  maven-policy:
+    name: Shared Maven policy
+    uses: HauntedMC/HauntedPlatform/.github/workflows/maven-ci.yml@10dfbacc8515208bf3b0ee236a8c7688fda49c9e # release hardening
+    with:
+      maven-command: ./mvnw -U -B -ntp validate
+    secrets:
+      PACKAGES_USER: ${{ secrets.HAUNTEDMC_PACKAGES_USERNAME || github.actor }}
+      PACKAGES_TOKEN: ${{ secrets.HAUNTEDMC_PACKAGES_TOKEN || github.token }}
+
+  tooling:
+    name: ShellCheck and version tooling
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - run: |
+          mapfile -d '' scripts < <(git ls-files -z '*.sh')
+          shellcheck tools/release/update-version "${scripts[@]}"
+        shell: bash
+      - run: gh extension install HauntedMC/gh-haunted-release --pin de43c102d81797001eef36fe45725744fdd22031
+      - run: ./tools/release/update-version --dry-run patch
+
+  ci-required:
+    name: ci-required
+    if: ${{ always() }}
+    needs: [tests, platform-acceptance, maven-policy, tooling]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    env:
+      CHECK_RESULTS: ${{ toJSON(needs) }}
+    steps:
+      - name: Require every validation job
+        run: |
+          python3 - <<'PYTHON'
+          import json
+          import os
+          results = {name: job['result'] for name, job in json.loads(os.environ['CHECK_RESULTS']).items()}
+          failed = {name: result for name, result in results.items() if result != 'success'}
+          if failed:
+              raise SystemExit(f'Validation did not pass: {failed}')
+          PYTHON