Keep Maven Resolver files out of Central release bundles

[bertysentry]

Summary

Apply the release-bundle fix from MetricsHub/workflows #39, included in v8, to Jawk's custom release workflow.

The 7.1.02 release used Maven 3.10.0 and Central rejected the bundle with Bundle has content that does NOT have a .pom file: io/jawk/jawk. The Central publishing plugin's staging install picks up Resolver metadata and tracking files.

Pass these options through the quoted release:perform -Darguments, alongside the existing GPG property:

• Disable VersionsMetadataGeneratorFactory to omit artifact-level version metadata.
• Disable EnhancedLocalRepositoryManagerFactory to omit _remote.repositories.
• Use rwlock-local for in-JVM locking.

These options apply only to the forked release build. Release preparation and snapshot deployment retain their existing settings because snapshots need versions metadata.

Validation

• All five workflows pass actionlint 1.7.12 and YAML parsing.
• All release step scripts pass Bash syntax checks. A stubbed Maven invocation verifies the GPG property and all three Resolver properties remain in one -Darguments value, including a workspace path with spaces.
• mvn formatter:format verify site succeeds on Maven 3.10.0 / Temurin 17. Unit tests: 891 run, 0 failures/errors, 11 skipped. Checkstyle, PMD, and SpotBugs report no findings.
• Compatibility-suite caveat: 944 run, 91 failures, 45 errors, 229 skipped; the existing POM tolerates these failures. No Java, test, or POM files change in this PR.
• Built unsigned Jawk 7.1.02 bundles in an isolated local copy with plugin 0.11.0. Baseline: 31 files, including maven-metadata-local.xml and _remote.repositories plus checksums. With the options: 25 files, all versioned artifacts/checksums, with no Resolver metadata, tracking files, or locks.
• Bundle-test uploads were directed to a reserved, non-listening loopback port using dummy credentials and failed locally as intended. No release was retried or published.
• git diff --check passes; only this workflow changes.

GitHub Actions passes for head 4b91769: Linux and Windows mvn verify site, Checkstyle, PMD, and SpotBugs. Actual Central acceptance remains to be checked in a separately authorized release run.

[bertysentry]

@codex Please review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T21:40:15.772174Z	4b91769	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 4b91769515

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".