[venkata-kishore]

Makes GitHub Packages a fallback for BonfireTrunk's own artifacts, so a library's pull request can build against another library's snapshot, published on request, or a release Central has not accepted yet, without spending a Maven Central release.

Pull request builds (maven-build.yml)

• Search order. Before building, the workflow writes a settings file that lists Maven Central first and https://maven.pkg.github.com/<owner>/* second. Repositories in settings are searched before the POM's, so Central stays the source for everything it has.
• Scope. A resolver groupId filter limits GitHub Packages to today.bonfire.oss. No other artifact can come from it.
• Snapshots. They are re-checked on every build (updatePolicy always), so a new snapshot is picked up even from a restored Maven cache.
• Auth. It uses the workflow's own GITHUB_TOKEN, so no secret is needed and library build.yml files don't change.
• Graceful fallback. A repo that can't reach GitHub Packages behaves exactly as before: it fails only when a dependency isn't on Central.

Release workflow (maven-release.yml)

• New snapshot job, opt-in. It runs only when the squash title of a merge into prime starts with Snapshot:, for example Snapshot: Add a borrow timeout, the same way a release needs Release X.Y.Z. GitHub matches the prefix without regard to case. It runs verify deploy:deploy to GitHub Packages with the library's maven-args, resolving like the PR build, and is not signed. If the pom version is not a -SNAPSHOT, it fails with an error, because the title asked for a snapshot. Other merges publish nothing and still show as skipped runs, so routine merges don't add snapshot builds. Callers already grant packages: write, so no caller change is needed.
• The release job still resolves from Central only. Its check step now also runs enforcer:enforce -Denforcer.rules=requireReleaseDeps. That fails early, with a clear error, on any SNAPSHOT dependency or SNAPSHOT parent.

README: a "GitHub Packages as a fallback" section, an updated table, and how to use snapshots locally with a classic token that has read:packages.

Tested

• Token. A throwaway workflow (Test: read Maven packages from other repositories (do not merge) #4, closed) showed that GITHUB_TOKEN downloads public Maven packages published from other repositories in the organization. That held with and without packages: read, and through the BonfireTrunk/* URL: 200 after a redirect to the registry file store, real POM content. A missing version returns 404.
• Search order and filter, locally, with the same settings and filter flags on the wrapper's Maven 3.10.0 (Resolver 2.0.24):
  • A today.bonfire.oss artifact that is on Central came from Central, with no GitHub request.
  • A missing one tried Central, then GitHub.
  • A third-party artifact never touched GitHub.
• Central-only guard, locally. A release-style, Central-only build refuses an artifact that an earlier build cached from github ("cached from a remote repository ID that is unavailable in current build context") and fails when Central lacks it. A release cannot pick up a GitHub-only artifact from a shared Maven cache.
• SNAPSHOT check, locally. requireReleaseDeps passes with release dependencies. It fails on a SNAPSHOT dependency ("is not a release dependency") and on a SNAPSHOT parent ("Parent Cannot be a snapshot").
• On GitHub, via a throwaway caller PR (closed):
  • The PR build through maven-build.yml@github-packages-fallback succeeded.
  • A manual release run through maven-release.yml@github-packages-fallback parsed the new file, and both jobs skipped as designed.
• Not run yet. The snapshot job itself only runs on a push to prime, so its first real run will be the first Snapshot: merge after this lands. The parse check above ran before the job became opt-in; that later change touches only its if and its non-SNAPSHOT message. actionlint was not run on this change.