build(release): add sources/javadoc jars profile + canonicalise SCM block (D1)

[DemchaAV]

Summary

Wires up Track D1 from the readiness taskboard — the first step of the Maven Central pipeline. Two changes, both prerequisites for Central upload:

1. New release Maven profile

Activated with -P release. Attaches the *-sources.jar and *-javadoc.jar that Central requires alongside the main .jar:

Plugin	Goal	Phase	Configuration
maven-source-plugin 3.3.1	jar-no-fork	package	default
maven-javadoc-plugin 3.12.0	jar	package	doclint=none, failOnError=false, quiet=true

The Javadoc plugin's failOnError=false is intentional — Lombok-generated members and the @Internal engine surface (e.g. document.layout.*) are not part of the public Javadoc contract, and a strict Javadoc pass would block the publish on things that aren't real problems. Warnings surface quietly so a maintainer running the profile by hand sees them, but they don't fail the build.

The profile is off by default so a maintainer's everyday mvnw verify does not pay the ~30 s of extra packaging. cut-release.ps1 (after Track D3's central-publishing-plugin lands) and the publish workflow (Track D4) will activate it.

2. SCM block canonicalised

Central's metadata validator is strict about the <scm> block:

-<connection>scm:git:git://github.com/DemchaAV/GraphCompose.git</connection>
-<developerConnection>scm:git:ssh://github.com:DemchaAV/GraphCompose.git</developerConnection>
+<connection>scm:git:https://github.com/DemchaAV/GraphCompose.git</connection>
+<developerConnection>scm:git:ssh://git@github.com/DemchaAV/GraphCompose.git</developerConnection>

• <connection> flipped from the legacy git:// (Git's anonymous transport, deprecated and blocked by many corporate networks) to https:// — the universal anonymous-clone protocol.
• <developerConnection> flipped from ssh://github.com:DemchaAV/… (the older SCP-like form) to ssh://git@github.com/… (the canonical SSH URL with the git@ user, the shape GitHub itself recommends).

Both lines now match the exact shape every Central artefact's POM carries — and the shape the audit notes pinned as a precondition for central-publishing-plugin validation.

Verification

$ ./mvnw -B -ntp -DskipTests -P release package -pl .
[INFO] Building jar: .../target/graphcompose-1.6.5.jar
[INFO] Building jar: .../target/graphcompose-1.6.5-sources.jar
[INFO] Building jar: .../target/graphcompose-1.6.5-javadoc.jar
BUILD SUCCESS (36s)

Artefact sizes confirmed against the produced files:

Jar	Size
graphcompose-1.6.5.jar	19 MB
graphcompose-1.6.5-sources.jar	18 MB
graphcompose-1.6.5-javadoc.jar	4 MB

Default mvnw verify (no profile) unchanged — sources / javadoc jars are not produced.

CHANGELOG entry added to v1.6.6 — Planned under ### Build.

What this doesn't do

• No GPG signing yet — that's Track D2. Central will reject unsigned artefacts; D2 lands the maven-gpg-plugin and the MAVEN_GPG_PRIVATE_KEY + MAVEN_GPG_PASSPHRASE secrets.
• No publishing wiring — that's Track D3 (central-publishing-maven-plugin + namespace verification on Central Portal).
• No publish workflow — that's Track D4 (.github/workflows/publish.yml).

D2 / D3 / D4 will land sequentially; this PR is just the artefacts layer.

Test plan

• mvnw -P release -DskipTests package -pl . produces all three jars
• Default mvnw verify unchanged (no profile activation)
• SCM block matches the canonical Central shape
• CI green on PR (the enforcer added in #93 revalidates plugin versions on the validate phase before any of this runs)
• Reviewer skim — the release profile block (~45 LOC) and the two SCM-line replacements are the load-bearing pieces
• (Out of scope) follow-up: track D2 GPG signing