ci: add verified Maven Central publication and deployment recovery

[moonyue-w]

Change

Java currently has a read-only release preflight but no path to publish and verify Maven Central packages. Add a manual workflow that checks the selected source and five-JDK CI, signs and retains the exact candidate bundle, records the Central deployment ID, verifies public Maven files and a clean consumer, then creates matching GitHub Release notes. A dispatch from main proceeds automatically after preflight, without a separate environment approval; publishing credentials come from repository Actions secrets.

Recovery reuses the original signed archive and deployment instead of uploading a replacement. Source tags bind the source SHA, batch and bundle digest. The publishing account's access to the verified com.qoder namespace, signing key and repository secrets still need setup; branch/tag rules and a release environment are optional. This PR does not publish a version or change SDK runtime code. Registration and recovery instructions are in docs/releasing.md.

Validation

• Local JDK 17 make quality, 38 maintenance-script tests, actionlint and git diff --check passed.
• GitHub CI passed on Java 8/11/17/21/25, plus the quality job.
• Preflight regression coverage accepts a repository with no environment/protection API calls while rejecting a changed main SHA or failed required CI job. Non-main dispatches and SNAPSHOT versions remain rejected.
• The quality job's disposable-key Maven signing exercise passed: identical SDK/POM/sources/Javadoc bytes, four verified signatures, and no Central upload.
• Actual Portal authentication, namespace authorization and public publication are untested until the publisher account is configured. No live API acceptance tests were rerun.