build: source module coordinates from gradle.properties and document the publishing convention

Set group/version once in gradle.properties, which Gradle applies to the
root project and every subproject, removing the duplicated literals from
the root build script and the published-module convention plugin. A
coordinate bump is now a single one-line edit. Published POM coordinates
are unchanged (org.dexpace / 0.0.1-alpha.1).

Document the dexpace.published-module convention in CLAUDE.md so new
modules apply the plugin rather than re-inlining a publishing block.

Author: OmarAlJarrah

CLAUDE.md

@@ -105,6 +105,12 @@ Layered, from the bottom up:
   public entry point (e.g. only `OkioIoProvider` is public in `sdk-io-okio3`).
 - **`sdk-core` has zero non-SLF4J runtime deps** — I/O, Jackson, and concurrency libraries live only in
   adapter modules. SLF4J is `compileOnly` (added by the root build to every Kotlin module).
+- **Published modules apply `id("dexpace.published-module")`** — the convention plugin in the `build-logic`
+  included build (`build-logic/src/main/kotlin/dexpace.published-module.gradle.kts`) carries the
+  `maven-publish` + `signing` setup, shared POM, staging repo, and CI-gated signing. Do not re-inline a
+  `publishing {}`/`signing {}` block in a module; a new publishable module just applies the plugin, and a
+  module that must not be published simply omits it. Coordinates (`group`/`version`) come from
+  `gradle.properties` and apply to every project.
 - **Commit style:** `feat:` / `test:` / `docs:` / `chore:` prefixes; `merge:` for work-unit merge commits.
 
 ## Things That Will Bite You

build-logic/src/main/kotlin/dexpace.published-module.gradle.kts

@@ -21,13 +21,10 @@ plugins {
     signing
 }
 
-// Coordinates. The group and version are the same for every published module and match the
-// values declared on the root project; keeping the single literal here makes a coordinate
-// change a one-file edit instead of a nine-file edit. The root `build.gradle.kts` still declares
-// its own `group`/`version`, so a version bump must update both literals until they are sourced
-// from one place (e.g. a `gradle.properties` entry read by both).
-group = "org.dexpace"
-version = "0.0.1-alpha.1"
+// Coordinates (`group`/`version`) are not set here. Gradle applies them from the repository-root
+// `gradle.properties` to the root project and every subproject, so each consuming module already
+// carries the shared `org.dexpace` coordinates and current version by the time this plugin runs —
+// a coordinate bump is a one-line edit in that file.
 
 // The `library` publication is built from the `java` software component, which only exists once a
 // `java`/`java-library`/`kotlin("jvm")` plugin is applied. Every current consumer applies

build.gradle.kts

@@ -38,8 +38,8 @@ plugins {
     alias(libs.plugins.detekt)
 }
 
-group = "org.dexpace"
-version = "0.0.1-alpha.1"
+// `group` and `version` are set once in `gradle.properties` and applied by Gradle to the root
+// project and every subproject — see that file.
 
 // Coverage: aggregate every Kover-enabled subproject through this root project's reports.
 dependencies {

gradle.properties

@@ -1 +1,9 @@
 kotlin.code.style=official
+
+# Project coordinates. Gradle applies `group` and `version` from gradle.properties to every
+# project in this build, so the root and all published modules share one source of truth — no
+# per-module or per-script literal. A coordinate bump is a one-line edit here. (The `build-logic`
+# included build is a separate build with its own scope and does not read these; it needs no
+# coordinates of its own.)
+group=org.dexpace
+version=0.0.1-alpha.1