build: add gated Maven Central release pipeline

[omandryk]

Summary

• move GPG signing into an explicit release Maven profile
• add Central Publisher Portal plugin 0.11.0 with autoPublish=false
• add a manual release workflow with separate verify/upload modes
• require a matching non-SNAPSHOT v* tag and the maven-central environment before upload
• document secrets, signing fingerprint, safety gates, and the release sequence

Safety properties

• normal pushes and pull requests cannot invoke deployment
• verify mode is credential-free and is the workflow default
• upload only creates a Central deployment for validation; it cannot automatically publish it
• no credentials or private key material are committed

Verification

• mvn clean verify
• mvn clean verify -Prelease -Dgpg.skip=true
• effective POM resolves central-publishing-maven-plugin:0.11.0 and autoPublish=false
• YAML parses successfully
• repository secret-pattern scan found no committed credential/private-key material

No artifact, tag, GitHub Release, or Central deployment was created.