Attach every Central artifact to the GitHub releases and prune the snapshot pre-release

[bernardladenthin]

Summary

Measured on snapshot build 20261012.035453: Maven Central was complete, while the GitHub release of the same build had no .pom at all, no llama-platform (the pom-only module consumers are told to depend on), the AARs attached unsigned although Gradle had written their .asc next to them, and the agent's thin jar never attached. The signature check globbed *.jar only, so the unsigned AARs never turned the job red. And the snapshot pre-release accumulated: 208 assets, 109 of them from 5.0.x, 43 in shapes that no longer exist, plus three SpotBugs plugin jars from 2026-05.

• Collect steps (publish-snapshot and publish-release): every module's jars and poms with their .asc -- maven-gpg writes target/<artifactId>-<version>.pom next to its .pom.asc, also for llama-parent and llama-platform (verified locally for jar and pom packaging) -- the agent's jars and pom, and the two AARs with their .aar.asc, their poms (build/publications/<publication>/pom-default.xml) and the shared sources/javadoc jars (build/distributions/) under Central's names.
• Signature check: counts *.jar, *.aar and *.pom; the attach-first contract (annotate, upload anyway, fail afterwards) is unchanged.
• github-snapshot prunes: a new step after the upload deletes every asset the run did not upload, each printed by name. The keep-set is the uploaded directory, never a version pattern. github-release-signed never deletes.
• CHANGELOG, CLAUDE.md; the cross-repo policy lives in workspace (fat-jar-release-assets.md).

The same change lands in BitcoinAddressFinder, srcmorph and streambuffer, whose github-snapshot / github-release jobs are shared text; this repository's copies are not in its manifest.

Test plan

• Affected unit / integration tests pass locally (below)
• CI is green on this branch
• Docs / CHANGELOG updated where applicable
• The new collect step run locally against a signed test build (throwaway key, dummy Android natives): it gathers exactly Central's file set, every .pom / .pom.asc / .aar.asc included
• The prune step run against a stubbed gh: deletes exactly the names not in the upload, prints each, no-op message when nothing is stale
• The report step: missing=1 for an unsigned AAR, missing=-1 for an empty directory
• check-run-scripts.py (162 scripts parse), check-release-gate.py, check-shared-files.py --offline, buildcheck unit tests
• First snapshot run: the job log names every removed asset; the release's asset set should then equal each module's Central maven-metadata.xml minus the checksum files

Related issues / PRs

• Sibling PRs: BitcoinAddressFinder, srcmorph, streambuffer (shared job text), workspace (policy)
• Policy: workspace/policies/fat-jar-release-assets.md, "Attach first, then go red" and "The snapshot pre-release holds exactly the current upload"

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits (the commit is a plain sentence, like the repository's history)
• No security-sensitive changes (if there are, I have notified the maintainer privately per SECURITY.md)

🤖 Generated with Claude Code

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud