fix(FEL-623): publish Gradle plugin sources

[codeyousef]

What changed

• publish a real aether-plugin-0.6.0.0-sources.jar
• validate the exact 75-coordinate Central bundle and every binary component's sources/Javadoc companions before upload
• split signing/upload/status polling so an accepted deployment ID is persisted immediately
• bind recovery to the failed deployment, exact commit, deterministic deployment name, and complete PURL manifest
• wait for PUBLISHED before repairing the tag or updating the GitHub release
• move signing passphrases out of process arguments and document the recovery procedure

Root cause

The 0.6.0.0 workflow treated Central's HTTP 201 upload acceptance as publication success. The aether-plugin JVM module did not enable withSourcesJar(), so Central later failed deployment e4df03ff-971d-4b12-b5cb-da68bbefa81a with “Sources must be provided but not found in entries.”

Verification

• ./gradlew verifyCentralPublicationArtifacts -Dmaven.repo.local=/tmp/aether-central-repair-m2 --no-daemon --stacktrace (75 coordinates)
• ./gradlew verifyExpectedSourceTasks check -x wasmJsBrowserTest --dependency-verification=strict --no-daemon --stacktrace
• npm test --prefix e2e-tests
• npm run typecheck --prefix e2e-tests
• actionlint .github/workflows/publish.yml
• git diff --check