Attach the pom to the GitHub releases and prune the snapshot pre-release

[bernardladenthin]

Summary

Cross-repo change (java-llama.cpp, BitcoinAddressFinder, streambuffer, this repository): the GitHub release assets were incomplete against Maven Central and the snapshot pre-release accumulated. Measured, not suspected: this repository's snapshot release holds 16 assets and every one is stale -- the 0.1.0 / 1.0.1 snapshots of the old llamacpp-ai-index-maven-plugin coordinates and four SpotBugs plugin jars (fb-contrib-7.6.4, fb-contrib-7.7.4, findsecbugs-plugin-1.13.0, findsecbugs-plugin-1.14.0) an old collect step uploaded from target/spotbugs/ in 2026-05/06.

• Collect steps (publish-snapshot and publish-release): the reactor loop now covers . (the srcmorph-parent pom, a Central artifact of its own) and copies <artifactId>-<version>.pom + .pom.asc next to the jars of every module (maven-gpg writes both into target/); the fat-jar exclusion is unchanged.
• Signature check of the attach jobs: counts every attachable type (*.jar, *.aar, *.pom) instead of jars alone; the attach-first contract (annotate, upload anyway, fail afterwards) is unchanged.
• github-snapshot prunes: a new step after the upload deletes every asset the run did not upload, each printed by name. The keep-set is the uploaded directory, never a version pattern. github-release never deletes.
• github-snapshot / github-release stay byte-identical with BitcoinAddressFinder and streambuffer; the manifest is rewritten with check-shared-files.py --write (the shared-files job warns about the siblings until their PRs are merged, as on every sync).
• CHANGELOG, CLAUDE.md; the policy text lives in workspace (fat-jar-release-assets.md).

Test plan

• Affected unit / integration tests pass locally (below)
• CI is green on this branch
• Docs / CHANGELOG updated where applicable
• The prune step run against a stubbed gh: deletes exactly the names not in the upload, prints each, no-op message when nothing is stale; the report step: missing=1 for an unsigned artifact, missing=-1 for an empty directory
• maven-gpg's target/<artifactId>-<version>.pom + .pom.asc naming verified with a throwaway key, for jar and pom packaging
• check-run-scripts.py, check-release-gate.py, check-shared-files.py --offline, buildcheck unit tests
• First snapshot run: the job log names every removed asset (all 16 here)

Related issues / PRs

• Sibling PRs: bernardladenthin/java-llama.cpp#529, bernardladenthin/BitcoinAddressFinder#385, streambuffer (shared job text), workspace (policy)

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits (the commit is a plain sentence, like the repository's history)
• No security-sensitive changes (if there are, I have notified the maintainer privately per SECURITY.md)

🤖 Generated with Claude Code

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2

---

Generated by Claude Code