Add tag-triggered Maven Central release workflow

[aruis]

Summary

• add a release workflow that publishes to Maven Central on v*.. tag pushes
• allow release credentials to come from GitHub Actions secrets while keeping local Gradle properties support
• add release tag and credential verification tasks plus release docs

Verification

• ./gradlew test
• GITHUB_REF_NAME=v3.26.12 ./gradlew verifyReleaseTagVersion
• ./gradlew verifyReleaseCredentials
• ./gradlew publishReleaseToSonatype -m
• git diff --check

Note: repository release secrets have been configured via gh secret set.