CI: pass -Dmaven.repository.credentialScope=id to every deploy (Maven 3.10)

[bernardladenthin]

Summary

• The runners now ship Maven 3.10, which sends a <server>'s credentials only to its declared origins. For the id central that is https://repo.maven.apache.org, so a snapshot upload to central.sonatype.com/repository/maven-snapshots/ goes out without credentials and fails with HTTP 401. java-llama.cpp hit this in run 37643964068 ("Not using credentials of server 'central' …").
• Both deploy steps (snapshot and release) now pass -Dmaven.repository.credentialScope=id, Maven's own switch back to id-only matching. The workflow comment says to replace it with setup-java's mvn-server-repository-origins once a setup-java release ships that input (feat: support Maven server credential origins actions/setup-java#1282 is merged but not released).

Test plan

• check-run-scripts.py, check-shared-files.py and check-release-gate.py report nothing.
• CI is green on this branch.
• The snapshot deploy succeeds after merge. The upload runs only on main, so the PR cannot verify it.
• CHANGELOG updated.

Related issues / PRs

Same change as the java-llama.cpp PR.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits. They use the repository's usual CI: prefix instead.
• No security-sensitive changes. Credentials are still scoped per step.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2

---

Generated by Claude Code

[claude]

✅ Review Complete

This PR correctly addresses the Maven 3.10 credential scoping issue:

• The fix is consistently applied to both snapshot and release deploy steps
• Comments clearly document the temporary workaround and planned replacement with setup-java's mvn-server-repository-origins
• CHANGELOG entry comprehensively describes the issue and fix
• Security boundaries are maintained (credentials scoped per step via env vars)
• Cross-reference to java-llama.cpp shows this is a known pattern across shared repos

No issues identified. Ready for merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.99%. Comparing base (1f04ea8) to head (d05de24).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #171   +/-   ##
=========================================
  Coverage     96.99%   96.99%           
  Complexity      116      116           
=========================================
  Files             1        1           
  Lines           266      266           
  Branches         29       29           
=========================================
  Hits            258      258           
  Misses            2        2           
  Partials          6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[coveralls]

Coverage is 99.248% — claude/hopeful-pascal-9jlbqb into main. No base build found for main.