Automate Java SDK releases

[eamsden]

What changed?

• Replaced the manually dispatched Java release workflow with a change-driven workflow that derives the version and tag from exactly one newly added releases/v* file.
• Added a release-note pull-request preflight that runs the same metadata, POM provenance, six-platform native build, packaging, checksum, and artifact-transfer jobs while making the publication job push-only.
• Builds and validates all native executables before a protected release environment approval.
• After approval, publishes Maven artifacts, closes and releases the Sonatype staging repository, waits for Maven Central propagation with bounded retries, creates the exact release tag, and publishes a GitHub release with verified native assets and checksums.
• Pins the release to one immutable commit and records that commit in published POM metadata so reruns can distinguish a valid completed publication from a coordinate collision.
• Added idempotent GitHub release handling, retry-aware Central polling, bounded retries for transient Linux native-image Docker build failures, and strict fail-closed validation.

Why?

The current process requires operators to type a tag, publish through the Sonatype UI, find and publish a GitHub draft release, and coordinate native asset attachment inside a short timing window. This removes those manual and timing-dependent steps while preserving one explicit human approval before any public release mutation.

Breaking changes?

No public API changes. The operational release process changes after the documented repository protections are configured.

Server PR

N/A.

Before merge

• Configure the protected release environment and its required reviewers, with self-approval and administrator bypass disabled and deployment branches restricted.
• Move the existing release credentials into that environment and add the documented sentinel environment secret.
• Set Actions artifact retention to at least 90 days.
• Add the documented v* tag ruleset that permits creation but prevents tag updates and deletion.

Validation

• The real Prepare release preflight run from temporary validation PR DO NOT MERGE: Validate release-note PR preflight #2980 completed successfully in about nine minutes. It resolved metadata, validated POM provenance, built and uploaded all six native executables, packaged all six archives, and generated verified checksums. Publish release was skipped before environment evaluation. The validation PR was closed without merging.
• Independently downloaded the workflow archives, verified every SHA-256 entry, confirmed executable modes in all five tarballs, and inspected the Windows zip.
• Published all 17 real Gradle Maven publications offline to a temporary file repository using version 9.8.7, an exact synthetic commit, and an isolated throwaway GPG key: 83/83 artifacts had valid signatures, 732/732 checksum sidecars matched, and all 17 POMs contained the exact SCM commit.
• A separate offline consumer resolved the local temporal-sdk and temporal-serviceclient publications and compiled against WorkflowClient.
• Exercised the real Maven Central polling script against existing 1.37.0 and a nonexistent coordinate; success and bounded 404 retry/exhaustion behaved as expected.
• actionlint
• bash -n for the release helper scripts
• YAML parsing and git diff --check
• ./gradlew --offline --no-daemon spotlessApply
• ./gradlew --offline --no-daemon spotlessCheck
• ./gradlew --offline --no-daemon test
• Verified closeAndReleaseSonatypeStagingRepository is available.

No GitHub environment was entered. No Sonatype endpoint, release credential, Maven publication, tag creation, or GitHub release operation was invoked.

[eamsden]

Closing in favor of #2986, which implements the release automation with a Temporal Worker running in GitHub Actions.