Cut over to the Code Genome Project for publishing and org.openrewrite resolution

[timtebeek]

Completes the cutover to the Code Genome Project: snapshots publish there instead of Sonatype, nothing publishes to Sonatype or Maven Central at all, and org.openrewrite/io.moderne artifacts are no longer consumed from Maven Central.

Publishing

• plugin/build.gradle.kts registers CGP's S3 bucket as a Maven publishing repository, mirroring org.openrewrite.build.publish-cgp — this repo can't apply that plugin, since it wires nebula and gradle-nexus.publish-plugin directly. The host is region-qualified because Gradle's S3 transport otherwise defaults to us-east-1.
• .github/workflows/ci.yml publishes :plugin:publishPluginMavenPublicationToCgpRepository with the CGP_AWS_* org secrets, replacing the Sonatype and OSSRH signing credentials. The signing properties were dead already — no signing plugin is applied anywhere in this build.
• build.gradle.kts drops io.github.gradle-nexus.publish-plugin and its nexusPublishing block. These were vestigial: org.openrewrite:plugin was never on Maven Central (repo1.maven.org 404s for it), because releases go to the Gradle Plugin Portal via publishPlugins and nothing ever invoked publishToSonatype. cgp is now the only Maven publishing repository.

Resolution

• Removes the central.sonatype.com/repository/maven-snapshots repository.
• Excludes org.openrewrite and io.moderne from both mavenCentral and gradlePluginPortal (which proxies Central) whenever CGP credentials are configured, so those groups resolve from CGP alone. This follows the codegenomeConfigured pattern from rewrite-build-gradle-plugin — gating on credentials keeps fork PRs, which receive no secrets, building against Central.
• mavenCentral stays for third-party dependencies.

Verification

Run locally with real CGP credentials, so the credentialed path was genuinely exercised rather than falling back to Central:

• Snapshot resolution: every org.openrewrite dependency resolves from CGP at 8.91.0-SNAPSHOT with Central excluded, including the org.openrewrite.gradle.tooling subgroup.
• Release resolution (-Preleasing): latest.release resolves to 8.90.4 from CGP.
• Release task graph (final publishPlugins --dry-run against a throwaway local tag) is unchanged and contains no Sonatype step.
• All *Sonatype* tasks are gone; publishPluginMavenPublicationToCgpRepository resolves through jar → javadocJar → sourcesJar → POM → publish. The build still configures cleanly with no AWS credentials present.

Worth flagging

• Snapshots become credentialed. artifacts.codegenomeproject.org returns 401 anonymously where the Sonatype snapshot repo did not, so anyone consuming org.openrewrite:plugin:*-SNAPSHOT without credentials needs a CGP download token. README updated accordingly.
• The publish step is not exercised by PR CI — it's gated on github.event_name != 'pull_request', so the first real upload happens on merge to main.
• Now that cgp is the only publishing repository, :plugin:publish would also push the plugin marker (publishRewritePluginMarkerMavenPublicationToCgpRepository), which would make snapshots consumable via plugins { id("org.openrewrite.rewrite") version "…-SNAPSHOT" } and retire the useModule workaround in the README. Left out as out of scope; happy to add.