Automate signed Maven publication for the reusable library modules

[TaeHuiKKIM]

Goal

Make the core, report, instrumentation, Spring MVC, and Spring WebFlux modules consumable without publishToMavenLocal.

Acceptance criteria

• choose and document a public Maven repository
• publish sources JARs and POM license, SCM, and developer metadata
• sign release artifacts and document key handling
• run a clean consumer sample against the published coordinates
• keep the shaded Java agent as a matching GitHub Release artifact
• document rollback and version compatibility policy

This issue does not publish credentials or perform a release from an unreviewed branch.

[lsmin3388]

Status after v0.2.0 — the automation is in place, the publication has not happened. Keeping this open, because two acceptance criteria are genuinely unmet.

Done:

• repository chosen and documented — Maven Central through the Central Portal.
• sources JARs and POM metadata — sources and javadoc JARs, plus name, description, url, license, developers, and SCM per module. Six modules publish: core, instrumentation, report, spring-mvc, spring-webflux, and the new spring-boot-starter.
• signing and key handling — ./gradlew centralBundle stages the whole upload layout and signs it from REQOVER_SIGNING_KEY / REQOVER_SIGNING_PASSWORD, using only Gradle's built-in maven-publish and signing plugins. Signing is skipped when no key is present so a clone still builds. The release workflow verifies every jar and pom has a matching .asc before uploading, and uses publishingType=USER_MANAGED so a human presses publish.
• shaded agent as a matching Release artifact — plus reqover-cli now.

Not done:

• a clean consumer sample against the published coordinates — nothing is published yet, so this cannot be exercised.
• rollback and version compatibility policy — not written. Central releases are permanent, so this should exist before the first publish, not after.

The job is also deliberately inert: it only runs when the repository sets PUBLISH_TO_MAVEN_CENTRAL and the three secrets, so tagging cannot publish by accident.