[b-re-w]

Closes #102

Written now; nothing can upload until the user creates the maven-central environment with its secrets and publishes a packpack-v* release.

Feature added

• Coordinates in one place: gradle.properties holds mavenGroup and packpackVersion, which packpack/build.gradle.kts reads. A group unification (python-multiplatform Cargo backend, stage 2: build Rust crates for Android and iOS (#94) #95) is one line.
• .github/workflows/publish-maven.yml, on a published Release tagged packpack-v<version>, in the maven-central environment:
  1. the tag must name packpackVersion, and the version must not already be on Central;
  2. a missing secret (SIGNING_KEY, SIGNING_KEY_PASSWORD, CENTRAL_PORTAL_USERNAME, CENTRAL_PORTAL_PASSWORD) stops the job, naming it;
  3. centralBundle stages and signs the bundle;
  4. check_central_bundle.py checks it;
  5. it is kept as an artifact;
  6. it is uploaded to the Central Portal as USER_MANAGED. The Portal validates it and waits for a person to press Publish, a second gate after the tag.
• Rehearsal: a manual run does everything except the upload, unsigned when there is no key.
• publish-pypi.yml: now runs only for v* releases, so a packpack-v* release does not fail the CLI's PyPI job.

Verification

• YAML parses (actionlint is not installed here).
• The dry-run steps, run locally:
  • the coordinate is read from gradle.properties (org.thisisthepy.python.multiplatform:packpack:0.1.0);
  • Central returns 404 for it, so the version is new;
  • centralBundle builds unsigned, and the check passes with --unsigned.
• Not verified: the job's environment expression (none for a manual run, maven-central for a release) and the Portal upload. A manual dispatch needs the workflow on the default branch (main), which it reaches with the next release sync; a real upload needs the user's secrets.

Documentation corrected

SPEC, Distribution through Maven Central: the release steps and the one place the coordinates are written.