ci: add publish workflow for Maven Central

Triggers on v* tags. Uses actions/setup-java server-id=central
with CENTRAL_USERNAME/CENTRAL_PASSWORD/GPG_PRIVATE_KEY/GPG_PASSPHRASE
secrets from the maven-central environment.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: dfa1

.github/workflows/publish.yml

@@ -0,0 +1,35 @@
+name: Publish to Maven Central
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: maven-central
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 25 with Maven Central publishing
+        uses: actions/setup-java@v4
+        with:
+          java-version: '25'
+          distribution: 'zulu'
+          cache: 'maven'
+          server-id: central
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_PASSWORD
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg-passphrase: GPG_PASSPHRASE
+
+      - name: Publish to Maven Central
+        env:
+          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
+          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        run: ./mvnw deploy -Prelease -DskipTests --batch-mode