Automate signed releases, SBOMs, changelog, and consumer verification

[juherr]

Goal

Make every release reproducible, signed, auditable, and verified from a consumer perspective.

Scope

• Automate Maven Central staging and publication.
• Sign artifacts and tags.
• Generate and publish an SBOM.
• Generate human-oriented release notes from curated changelog entries.
• Verify a minimal clean consumer against staged artifacts.
• Add rollback and failed-release recovery guidance.

Acceptance criteria

• A release is triggered through a documented protected workflow.
• Artifacts, checksums, signatures, sources, Javadocs, and SBOM are published.
• A minimal consumer passes before promotion.
• Git tag, GitHub Release, and Maven Central artifacts identify the same commit.
• Failed staging cannot leave an ambiguous published version.

Planning

• Priority: P1
• Complexity: L