ci(publish): abort snapshot publish unless the POM version is a -SNAPSHOT

Add a guard step to the publish-snapshot job that resolves project.version via
`mvn help:evaluate` and fails the job unless the version ends in -SNAPSHOT.

central-publishing routes purely by version: a release version (no -SNAPSHOT)
deployed through the snapshot path lands in the permanent Maven Central release
store, not the snapshot store. This guard stops that from ever happening from the
snapshot job; releases continue to go through the v* tag path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JGZdUCy6YnTzKSJKA6B6KZ

Author: claude

.github/workflows/publish.yml

@@ -906,6 +906,15 @@ jobs:
           server-password: MAVEN_PASSWORD
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
+      - name: Guard - require a -SNAPSHOT version
+        shell: bash
+        run: |
+          VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version | tail -n1)
+          echo "Resolved project version: $VERSION"
+          case "$VERSION" in
+            *-SNAPSHOT) echo "OK: -SNAPSHOT version, continuing snapshot deploy." ;;
+            *) echo "::error::Refusing to publish non-SNAPSHOT version '$VERSION' from the snapshot job. Snapshot publishing requires a -SNAPSHOT version; releases go through the v* tag path."; exit 1 ;;
+          esac
       - name: Publish snapshot
         run: mvn --batch-mode --no-transfer-progress -P release,cuda,opencl-android -Dmaven.test.skip=true deploy
         env: