build(release): add sources/javadoc jars profile + canonicalise SCM block (D1) (#95)

Wires up Track D1 from the v1.6.5->1.7 readiness taskboard - the first step of the Maven Central pipeline. Two changes, one PR, both prerequisites for Central upload:

1. New 'release' Maven profile activated with -P release. Attaches *-sources.jar (maven-source-plugin 3.3.1 jar-no-fork) and *-javadoc.jar (maven-javadoc-plugin 3.12.0 jar) to the package phase. Javadoc runs with doclint=none + failOnError=false so Lombok-generated members and @internal engine surface don't block a publish; warnings surface quietly. Off by default; default mvnw verify does not pay the ~30s of extra packaging.

2. SCM block canonicalised. Central metadata validator is strict: <connection> now scm:git:https:// (HTTPS, not legacy git://), <developerConnection> now scm:git:ssh://git@github.com/ (canonical SSH URL with git@ user). Matches every Central artefact's POM shape.

Verification:

  mvnw -P release -DskipTests package -pl .

  -> BUILD SUCCESS (36s)

  -> target/graphcompose-1.6.5.jar (19MB)

  -> target/graphcompose-1.6.5-sources.jar (18MB)

  -> target/graphcompose-1.6.5-javadoc.jar (4MB)

  -> Central jar trio complete; ready for GPG signing (D2) and central-publishing wiring (D3).

Author: DemchaAV

CHANGELOG.md

@@ -21,6 +21,24 @@ JitPack continue to resolve through the existing coordinates.
   `./mvnw -DskipTests -P japicmp verify -pl .`; HTML/MD/XML reports
   land in `target/japicmp/`. JitPack repository is scoped to the
   `japicmp` profile, so downstream consumers do not inherit it.
+- **`release` Maven profile with sources + javadoc jars** (Track D1).
+  Activated with `-P release`, attaches `*-sources.jar` and
+  `*-javadoc.jar` to the `package` phase via the standard
+  `maven-source-plugin` (3.3.1) and `maven-javadoc-plugin` (3.12.0)
+  configurations Maven Central requires. The Javadoc plugin runs with
+  `doclint=none` and `failOnError=false` so Lombok-generated members
+  and `@Internal` engine surface don't block a publish; warnings are
+  surfaced quietly. Default `mvnw verify` still does not pay the
+  ~30 s of extra packaging — the profile is off by default and turned
+  on by `cut-release.ps1` (once Track D3's central-publishing plugin
+  lands) and the publish workflow (Track D4).
+- **SCM block canonicalised** in `pom.xml` (Track D1 polish). The
+  Central metadata validator is strict about the `<scm>` block:
+  `<connection>` now uses `scm:git:https://…` (HTTPS, not the legacy
+  `git://` transport) and `<developerConnection>` now uses
+  `scm:git:ssh://git@github.com/…` (the canonical SSH URL with the
+  `git@` user, not the older `ssh://github.com:…` form). Matches the
+  shape every Central artefact's POM carries.
 - **New `benchmarks/README.md`** (Track B1). Honest framing for the
   manual benchmark layer ahead of the Maven Central debut: explicitly
   positions the harness as a smoke / diff / endurance tool — not a

pom.xml

@@ -35,8 +35,8 @@
     </developers>
 
     <scm>
-        <connection>scm:git:git://github.com/DemchaAV/GraphCompose.git</connection>
-        <developerConnection>scm:git:ssh://github.com:DemchaAV/GraphCompose.git</developerConnection>
+        <connection>scm:git:https://github.com/DemchaAV/GraphCompose.git</connection>
+        <developerConnection>scm:git:ssh://git@github.com/DemchaAV/GraphCompose.git</developerConnection>
         <url>https://github.com/DemchaAV/GraphCompose/tree/main</url>
     </scm>
 
@@ -68,6 +68,7 @@
         <maven.compiler.plugin.version>3.15.0</maven.compiler.plugin.version>
         <maven.enforcer.plugin.version>3.5.0</maven.enforcer.plugin.version>
         <maven.javadoc.plugin.version>3.12.0</maven.javadoc.plugin.version>
+        <maven.source.plugin.version>3.3.1</maven.source.plugin.version>
         <maven.surefire.plugin.version>3.5.5</maven.surefire.plugin.version>
 
         <!-- Minimum toolchain (enforced by maven-enforcer-plugin) -->
@@ -452,6 +453,65 @@
     </build>
 
     <profiles>
+        <!--
+            Maven Central / release-publishing artefacts. Activated
+            with `-P release`. Produces the `*-sources.jar` and
+            `*-javadoc.jar` Maven Central requires alongside the main
+            `.jar`. Activated by `cut-release.ps1` (when the
+            central-publishing plugin lands in Track D3) and by the
+            publish workflow (Track D4); never activated by the default
+            local build so a maintainer's everyday `mvnw verify` does
+            not pay the extra ~30 s of source / javadoc packaging.
+            Tracked in v1.6.6 stabilization (Track D1).
+        -->
+        <profile>
+            <id>release</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-source-plugin</artifactId>
+                        <version>${maven.source.plugin.version}</version>
+                        <executions>
+                            <execution>
+                                <id>attach-sources</id>
+                                <phase>package</phase>
+                                <goals>
+                                    <goal>jar-no-fork</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-javadoc-plugin</artifactId>
+                        <version>${maven.javadoc.plugin.version}</version>
+                        <executions>
+                            <execution>
+                                <id>attach-javadocs</id>
+                                <phase>package</phase>
+                                <goals>
+                                    <goal>jar</goal>
+                                </goals>
+                                <configuration>
+                                    <!--
+                                        Lombok-generated members and the
+                                        `@Internal` engine surface are not
+                                        part of the public Javadoc; skip
+                                        anything that would fail to resolve
+                                        rather than blocking the publish.
+                                    -->
+                                    <doclint>none</doclint>
+                                    <failOnError>false</failOnError>
+                                    <quiet>true</quiet>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+
         <!--
             Optional-deps regression: runs the canonical suite with
             `poi-ooxml` (and its transitives) excluded from the test