CI: Implement Automated Release Workflow for Maven Central Publishing

[Shaurya2k06]

Description

This PR adds a complete GitHub Actions release workflow that automates Maven Central
publishing. The workflow is triggered manually via workflow_dispatch, supports optional
version bumping, enforces required secrets validation, and creates GitHub Releases
with auto-generated release notes. No deployment occurs without all 5 secrets configured.

What changed

Added .github/workflows/release.yml (11 steps: verify secrets → build → deploy → tag → release)
Enforced fail-fast secrets validation to prevent cryptic Sonatype errors

Implementation Notes

• Trigger: Actions → Release → Run workflow (optional inputs: version, skip-tests)
• Secrets required (to be configured by maintainers): SONATYPE_USERNAME, SONATYPE_PASSWORD,
  GPG_PRIVATE_KEY, GPG_PASSPHRASE, GPG_KEYID
• JDK 11 (aligns with project target version)
• Workflow runs full test suite before deploy (unless skip-tests is checked)
• Git tag and GitHub Release auto-created from pom.xml version

Validation

Local testing confirmed:

• mvnw versions:set correctly bumps pom.xml
• mvnw help:evaluate correctly reads final version
• mvnw clean verify -Pci-cd succeeds (build, source-jar, GPG sign)
• mvnw clean deploy -Pci-cd fails at expected Sonatype auth boundary (not config error)
• Secrets check bash logic validates all 5 secrets; fails with clear error message if any missing
• YAML syntax valid
• Git tag/push logic works locally (test-then-cleanup)

Dry-run Test

This demonstrates the workflow correctly fails fast when secrets are unconfigured,
rather than silently continuing or failing deep in the deploy step. It also demonstrates how CI successfully passes when secret check is skipped.

Closes

#542

[frankgiordano]

I added the following secrets required:
SONATYPE_USERNAME
SONATYPE_PASSWORD
GPG_PRIVATE_KEY
GPG_PASSPHRASE
GPG_KEYID