fix(FEL-623): accept Central typed PURLs

[codeyousef]

What changed

• models Sonatype's exact status manifest as 75 base coordinates plus 35 KLIB type variants and one Gradle plugin-marker POM variant
• permits expected partial manifests only in transitional states and requires the exact 111 PURLs at PUBLISHED
• separates current workflow code from the original upload commit during resume
• keeps deployment-name validation, release notes, and tag repair bound to upload commit 4e86790
• makes generated 75/111 manifests cache-safe with their complete sorted sets as task inputs
• strengthens contract coverage for the no-upload resume path

Root cause

Deployment 7a3ef832-4930-42bb-a102-e64ba6ee5bb7 uploaded successfully and Central continued to PUBLISHED. The workflow stopped locally because Sonatype reports valid ?type=klib and ?type=pom PURL variants in addition to every expected base coordinate.

Safety

This patch is polling-only for the accepted deployment. Resume sets upload_required=false, skips signing/claim/upload, validates the exact deployment ID and deterministic name, and repairs v0.6.0.0 only after Central reports PUBLISHED with the exact 111-PURL set.

Verification

• npm test --prefix e2e-tests
• npm run typecheck --prefix e2e-tests
• /tmp/actionlint-1.7.12/actionlint .github/workflows/publish.yml
• ./gradlew writeExpectedCentralPurls writeExpectedCentralReportedPurls --no-daemon --stacktrace
• generated manifests: 75 base, 111 reported, 35 type=klib, 1 type=pom
• all 75 public 0.6.0.0 POM coordinates confirmed available
• aether-plugin binary, sources, Javadoc, POM, signatures, and checksums confirmed public
• independent resume-path/security review: no blocking findings