fix(FEL-623): accept Central typed PURLs

[codeyousef]

What changed

• models Sonatype's exact 111-PURL status manifest: 75 base coordinates, 35 KLIB variants, and the plugin marker POM variant
• rejects duplicate, non-string, unexpected, or incomplete PURLs at PUBLISHED
• runs current polling code while binding resume status, tag, and release notes to the original upload commit
• pins deployment 7a3ef832-4930-42bb-a102-e64ba6ee5bb7 to the audited release commit and manifest digests
• creates a durable single-use claim before every future Central upload
• rejects UUID case variants and rechecks the remote annotated tag object before repair

Root cause

Central accepted and published the corrected 0.6.0.0 bundle, but the local waiter expected only 75 unqualified PURLs. Sonatype also reports 35 legitimate ?type=klib variants and one ?type=pom plugin-marker variant, so the waiter failed while Central was VALIDATING.

Impact

No artifact upload is needed. After this merges, the workflow will resume the already-published deployment by exact ID, validate its exact component set, move v0.6.0.0 to the original upload commit, and update the GitHub release.

Verification

• npm test --prefix e2e-tests
• npm run typecheck --prefix e2e-tests
• actionlint .github/workflows/publish.yml
• ./gradlew writeExpectedCentralPurls writeExpectedCentralReportedPurls help --no-daemon --stacktrace
• generated manifests: 75 and 111 exact PURLs
• pinned manifest SHA-256 values independently reproduced
• all 75 Maven POM coordinates are public
• aether-plugin binary, sources, Javadoc, POM, signatures, and checksums are public
• independent adversarial review: no blockers