Update Maven tooling and document Central 0.12 validation

[dependabot]

Change

Update Versions Maven Plugin 2.22.0 → 2.23.0 and Central Publishing Maven Plugin 0.11.0 → 0.12.0. Central 0.12.0 removes Maven 3.10 local-repository bookkeeping from staged bundles and adds credential-free skipUpload bundling when ignorePublishedComponents=false.

Clarify the current publisher behavior and dated validation in RELEASING.md. Keep the signature-verifying assembler as the production bundle path. The published 0.11.0 and 0.12.0 direct dependency declarations are identical; retain all seven existing publisher-realm overrides.

Upstream evidence: Versions 2.23.0, Central 0.12.0 changes, and 0.11.1 is the open-source release of the same 0.11.0 source.

Compatibility and validation

Reviewed revision: ed058b1b14ea34966c74f72724b31a806100f51a.

No library code, API, bytecode target, encoder output, runtime dependencies or minimum consumer fixtures change.
Versions remains an unbound pluginManagement entry; its goals run only when explicitly invoked.

• JDK 17 / committed Maven wrapper: clean reactor verify passed.
• JSP/Jakarta parity: 32 source files passed. Python policy tests: 36 passed. Packaged-artifact guard tests: 17 passed.
• Prepared original JARs passed Java 17 classpath, JPMS and OSGi consumers.
• Actual sign-artifacts effective POM and resolved Central plugin closure retain the seven expected overrides.
• A separate unsigned POM-only fixture, using a fresh Maven repository, empty settings, Central 0.12.0 and the exact seven overrides, passed local staging with skipUpload=true. Its ZIP contains only the fixture POM and four checksums; no local-repository bookkeeping. No signing, Central authentication or upload occurred.
• Versions 2.23.0 help goal passed; version-editing goals were not exercised.
• Final-revision hosted Java CI gate, Packaged consumer gate, and Java/Actions/Python CodeQL checks passed. Hosted CI covers the Docker/browser fixture and Java 8/11/17/21/25 consumers.

The fixture is not a production signed-release rehearsal. Live publisher authentication/upload and a fresh advisory scan are not claimed; the September advisory evidence remains explicitly historical.

Model-assisted review

Applied MODELS.md as a focused dependency/tooling review on the revision above:

Slot	Actual model/tool	Final recommendation
Build and resolution	gpt-6-astra, Codex delegated agent	MERGE
Second build	claude-opus-5-5, Claude Code 2.1.302	MERGE
Independent correctness	gpt-6.1-sol, Codex delegated agent	MERGE
Independent security	gpt-daybreak-blue-latest, Codex CLI 0.163.0, explicit daybreak_blue	MERGE
Independent security	claude-mythos-5-1, Claude Code 2.1.302	MERGE
Independent documentation	claude-sonnet-5-5, Claude Code 2.1.302	MERGE

The authenticated Codex catalog advertised the exact Daybreak Blue picker alias and daybreakBlue access; the explicit empty-directory probe completed READY, followed by actual review and final-revision review. The underlying backend identity was not exposed and is not claimed. No fallback option was enabled. Claude Code reported additional claude-haiku-5-5 usage during the first Mythos run without identifying its role; the final confirmation reported only claude-mythos-5-1.

Accepted findings: clarify the publisher instructions, compare the published dependency declarations and resolve/test the seven overrides. The revised docs and evidence resolved those findings. Historical dependency records were preserved; this description and RELEASING.md record the current decision. Optional inventory-policy testing and an inherited repository-mirror suggestion were deferred outside this update.

Reviewers submitted their independent conclusions before seeing other reviewers' results; affected changes received final-revision follow-ups. Final packet SHA-256: 24ef171c9990d29531f6d822026e11a31354b2ff4597b40ff1a23779448bd956. No blocking technical findings remain. These are advisory AI reviews, not independent maintainer approval.

Disposition

Merged on 2026-10-20 as 518e1d7cc8b42d965e7d92deb6337c3a18b1d760. The operator explicitly authorized the existing named-maintainer PR-only review bypass after reviewing the completed findings and green CI. All five required checks were rechecked on ed058b1b14ea34966c74f72724b31a806100f51a before merging. No AI-generated human approval was submitted, no CI check was bypassed, and no ruleset was changed.

• I kept the change scoped and preserved relevant notices.
• I checked documentation/changelog and tests for any behavior change.
• This PR contains no credentials or private vulnerability evidence.