feat(kotlin): publish Kotlin SDK to Maven Central

[soamdesai-tfh]

What

Publishes the Kotlin SDK (com.worldcoin:idkit) to Maven Central, alongside the existing GitHub Packages publishing — so consumers can use implementation("com.worldcoin:idkit:<version>") with no authentication. The com.worldcoin namespace is already verified on the Sonatype Central Portal, so this is release-engineering wiring, not new infrastructure.

Changes

• Adopt the com.vanniktech.maven.publish plugin (0.34.0) for the bindings module
• Add a production-gated Maven Central publish step to publish-kotlin.yml; GitHub Packages publishing is unchanged
• Sign publications only when a signing key is supplied, so dev releases keep working
• verifyKotlinNativeLibraries fails any publish if an Android ABI's libidkit.so is missing or empty, preventing a broken AAR from reaching the (immutable) registry
• CI validates the publication via publishToMavenLocal (artifact set, POM metadata, native libraries bundled for all four ABIs)
• Add a relocation POM script for the renamed idkit-kotlin artifact
• README leads with Maven Central; GitHub Packages documented for dev builds

Verification

• Local: publishToMavenLocal produces a signed, complete publication (AAR + sources + javadoc + POM); the native-lib guard and PKG_VERSION override were confirmed
• Against Sonatype: a throwaway version uploaded to the Central Portal reached VALIDATED, then dropped — confirming credentials, namespace rights, and signature validation

---

Note

Medium Risk
Touches production release pipelines, Maven Central credentials, and signing; mistakes could publish incomplete or wrong artifacts, though Central-first ordering and native-lib guards reduce blast radius.

Overview
Adds Maven Central as the primary distribution path for com.worldcoin:idkit, while dev builds still go only to GitHub Packages.

The bindings module now uses com.vanniktech.maven.publish (0.34.0) instead of hand-rolled maven-publish POM wiring: Central publication, sources/javadoc jars, POM metadata, and GPG signing only when signingInMemoryKey is set. A verifyKotlinNativeLibraries Gradle check blocks any publish if an ABI’s libidkit.so is missing or empty.

CI runs publishToMavenLocal in the Kotlin job and asserts the full artifact set, required POM elements, and all four JNI ABIs inside the AAR. The publish workflow uploads to Maven Central first on production (signed, with Central secrets), then publishes to GitHub Packages via publishAllPublicationsToGitHubPackagesRepository so dev releases don’t hit Central or require signing.

Docs now lead with Maven Central; scripts/publish-relocation-pom.sh is a one-time helper for a relocation POM from legacy idkit-kotlin coordinates.

^{Reviewed by Cursor Bugbot for commit cff5e0d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

@soamdesai-tfh is attempting to deploy a commit to the Worldcoin Team on Vercel.

A member of the Team first needs to authorize it.