CI: pass -Dmaven.repository.credentialScope=id to every deploy (Maven 3.10)

[bernardladenthin]

Summary

• The runners now ship Maven 3.10, which sends a <server>'s credentials only to its declared origins. For the id central that is https://repo.maven.apache.org, so a snapshot upload to central.sonatype.com/repository/maven-snapshots/ goes out without credentials and fails with HTTP 401. java-llama.cpp hit this in run 37643964068 ("Not using credentials of server 'central' …").
• Both deploy steps (snapshot and release) now pass -Dmaven.repository.credentialScope=id, Maven's own switch back to id-only matching. The workflow comment says to replace it with setup-java's mvn-server-repository-origins once a setup-java release ships that input (feat: support Maven server credential origins actions/setup-java#1282 is merged but not released).

Test plan

• check-run-scripts.py, check-shared-files.py and check-release-gate.py report nothing.
• CI is green on this branch.
• The snapshot deploy succeeds after merge. The upload runs only on main, so the PR cannot verify it.
• CHANGELOG updated.

Related issues / PRs

Same change as the java-llama.cpp PR.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits. They use the repository's usual CI: prefix instead.
• No security-sensitive changes. Credentials are still scoped per step.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2

---

Generated by Claude Code

[claude]

Review Summary

This PR correctly addresses a Maven 3.10 compatibility issue affecting snapshot and release deployments.

Strengths:

• Correct diagnosis: Maven 3.10 restricts credentials to declared repository origins, causing deployments to the Sonatype snapshot repo to fail with HTTP 401
• Consistent fix: Both snapshot and release deploy steps are updated with the flag
• Clear documentation: CHANGELOG entry thoroughly explains the problem and solution
• Path forward: Comments correctly note this is temporary until setup-java ships the mvn-server-repository-origins input
• Proper testing: Local checks (check-shared-files.py, check-run-scripts.py) passed

Minor issues:

1. Line 729: The release deploy comment 'see the first deploy step of this file' is vague—should reference the snapshot deploy step explicitly
2. Lines 560-561: The suggested future replacement for setup-java spans lines awkwardly

Security: No concerns. The change maintains the same credential scoping semantics using Maven's id-based matching as a temporary compatibility workaround.

[claude]

The reference to "the first deploy step of this file" is vague. Consider being more explicit:

Suggested change

	# -Dmaven.repository.credentialScope=id: see the first deploy step of this file (Maven 3.10).
	# -Dmaven.repository.credentialScope=id: see the snapshot deploy step comment above for details (Maven 3.10).

This clarifies which step to refer to.

[claude]

The suggested replacement spans lines awkwardly. Consider one of these clearer alternatives:

Option 1 (single line):

Suggested change

	# Restores id-only matching; replace with setup-java's `mvn-server-repository-origins:
	# central:https://central.sonatype.com` once a release of setup-java ships that input.
	# Restores id-only matching; replace with setup-java's mvn-server-repository-origins once a release ships that input.

Option 2 (more explicit):

Suggested change

	# Restores id-only matching; replace with setup-java's `mvn-server-repository-origins:
	# central:https://central.sonatype.com` once a release of setup-java ships that input.
	# Restores id-only matching; replace with setup-java's mvn-server-repository-origins once a release ships that input
	# (with central:https://central.sonatype.com as the target).

This makes the intended future state clearer.