[brandur]

Allow maintainers to run the Java release procedure themselves or hand it to an agent by sharing only a temporary directory path. A new helper prompts for credentials without echoing, keeps them outside the checkout with owner-only permissions, supplies them to trusted commands through the environment, redacts command output, supports replacing an invalid Central token, and removes the temporary copies afterward. Maven signing continues to use Bouncy Castle.

Update the release instructions to use the helper and describe Portal API publication for agents. Configure Java workspace builds to skip Central's automatic prefix index, which can lag newly published namespaces and caused all eight Java CI jobs to fail their warning checks after the first release. Explicit local prefix filters, other repositories, and warning enforcement remain enabled.

Validation: make lint/java test/java/tools test/java/sqlite check/java/package passes without command-line workarounds, including 11 credential-helper tests and 513 Java/CLI tests. Direct Maven invocation from java/ also loads the configuration. All 13 release-document shell snippets parse in Bash and Zsh.

[brandur]

Putting through an update here that gets a release across the finish line, but yeah, the process for going to Maven Central is awful. With this in you can basically tell your agent "prepare the next Java release" and it'll walk you through it, but you do need a Maven Central token and published GPG key (terrible).

I'm going to investigate whether we should just be hosting the non-Pro version on our own gomod proxy or GitHub (if that's possible) to make things easier.

[bgentry]

@brandur just checking, are you wanting to go through with this one or going with an alternative?

[brandur]

@bgentry Nah, gonna try the alternative path.