fix(release): publishing_type=automatic, rename misleading transfer step

[aldefy]

Summary

1.0.0-beta18 (the first real Central Portal publish after #55) landed at VALIDATED on Sonatype's Portal, not PUBLISHED — confirmed via the Portal UI ("4 out of 4 Components Validated," blue badge, not green). That's because the transfer endpoint's default is user_managed, which needs a manual "Publish" click nothing in this pipeline was doing or even mentioning.

• Adds ?publishing_type=automatic to the transfer call so a validated deployment self-releases.
• Renames the step (was "Transfer staged deployment to the Central Portal" — read as done when it wasn't).
• Bumps to 1.0.0-beta19, no library changes — exists to verify auto-publish works end to end on a real tag.

Caveat

Sonatype's docs for this specific OSSRH-compat endpoint don't spell out publishing_type's transmission format precisely — query param is the standard REST convention and what's used here, but I couldn't get an authoritative source confirming it beyond that. Checked every other aldefy repo for prior art (compose-rebound, compose-shelf, swipe, compose-loupe, etc.) — none of them publish to Maven Central, so there's no working example in this org to copy. Verifying against 1.0.0-beta19 once this merges is the actual confirmation.

Test plan

• actionlint clean
• ./gradlew :lumen:apiCheck — passes
• Tag 1.0.0-beta19 after merge, confirm it shows as PUBLISHED on the Portal and appears at https://central.sonatype.com/artifact/io.github.aldefy/lumen/versions

[aldefy]

Superseded — closing in favor of a different, verified fix.

This PR's approach (adding `publishing_type=automatic` to the OSSRH-compat `manual/upload` endpoint) was based on a wrong assumption about how that endpoint batches uploads. Testing it for real on 1.0.0-beta18 showed the actual failure: that endpoint stages each Gradle publish task as its own implicit deployment, so a 7-publication KMP build only gets the last 1-2 artifacts into any single deployment — everything else silently never gets released. Confirmed on the Central Portal UI: beta18 published with only `lumen-iosx64` and `lumen-iossimulatorarm64`, missing Android/JVM/wasmJs/the KMP metadata module.

Checked aldefy/composeproof's release.yml (which already publishes successfully) for the actual working pattern: one atomic multipart bundle upload to Central's official Publisher API, not the OSSRH-compat endpoint at all. That's what the follow-up PR does.