Attach the pom to the GitHub releases and prune the snapshot pre-release

[bernardladenthin]

Summary

Cross-repo change (java-llama.cpp, BitcoinAddressFinder, srcmorph, this repository): the GitHub release assets were incomplete against Maven Central and the snapshot pre-release accumulated. Measured, not suspected: this repository's snapshot release holds 11 assets, five of them stale -- the 1.2.0-SNAPSHOT jar and javadoc jar (unsigned, from before the signature check existed) and three SpotBugs plugin jars (fb-contrib-7.6.4, fb-contrib-7.7.4, findsecbugs-plugin-1.14.0) an old collect step uploaded from target/spotbugs/ in 2026-05.

• Collect steps (publish-snapshot and publish-release): <artifactId>-<version>.pom + .pom.asc next to the jars (maven-gpg writes both into target/; Central had them, the release did not).
• Signature check of the attach jobs: counts every attachable type (*.jar, *.aar, *.pom) instead of jars alone; the attach-first contract (annotate, upload anyway, fail afterwards) is unchanged.
• github-snapshot prunes: a new step after the upload deletes every asset the run did not upload, each printed by name. The keep-set is the uploaded directory, never a version pattern. github-release never deletes.
• github-snapshot / github-release stay byte-identical with BitcoinAddressFinder and srcmorph; the manifest is rewritten with check-shared-files.py --write (the shared-files job warns about the siblings until their PRs are merged, as on every sync).
• CHANGELOG; a short "Release assets" section in CLAUDE.md; the policy text lives in workspace (fat-jar-release-assets.md).

Test plan

• Affected unit / integration tests pass locally (below)
• CI is green on this branch
• Docs / CHANGELOG updated where applicable
• The prune and report scripts of this repository's publish.yml run against a stubbed gh and fake asset sets: deletes exactly the names not in the upload and prints each; missing=1 for an unsigned artifact, missing=-1 for an empty directory
• maven-gpg's target/<artifactId>-<version>.pom + .pom.asc naming verified with a throwaway key
• check-run-scripts.py (59 scripts parse), check-release-gate.py, check-shared-files.py --offline, buildcheck unit tests
• First snapshot run: the job log names every removed asset

Related issues / PRs

• Sibling PRs: bernardladenthin/java-llama.cpp#529, bernardladenthin/BitcoinAddressFinder#385, bernardladenthin/srcmorph#223, workspace (policy)

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits (the commit is a plain sentence, like the repository's history)
• No security-sensitive changes (if there are, I have notified the maintainer privately per SECURITY.md)

🤖 Generated with Claude Code

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.99%. Comparing base (5ab7ab8) to head (7c97468).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #177   +/-   ##
=========================================
  Coverage     96.99%   96.99%           
  Complexity      116      116           
=========================================
  Files             1        1           
  Lines           266      266           
  Branches         29       29           
=========================================
  Hits            258      258           
  Misses            2        2           
  Partials          6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[coveralls]

coverage: 99.248%. remained the same — claude/hopeful-pascal-9jlbqb into main