build(release): add GPG signing plugin to release profile (D2)

[DemchaAV]

Summary

Wires up Track D2 — Maven Central rejects unsigned uploads; this PR adds maven-gpg-plugin 3.2.7 to the existing release profile so the main / sources / javadoc / pom artefacts are signed during the verify phase.

Off by default

Surface	Behaviour
mvn -P release package (local)	Signing skipped — no GPG key required. New <gpg.skip>true</gpg.skip> property in <properties> keeps every local invocation working.
mvn -P release -Dgpg.skip=false verify (manual)	Plugin attempts to sign. Without a configured key, expected GPG exit code 2.
Publish workflow (Track D4)	Flips -Dgpg.skip=false explicitly and provides MAVEN_GPG_PRIVATE_KEY + MAVEN_GPG_PASSPHRASE from repo secrets.

gpgArguments declares --pinentry-mode loopback so non-interactive CI runs accept the passphrase from -Dgpg.passphrase / MAVEN_GPG_PASSPHRASE without needing a TTY for gpg-agent.

Verification

Default (skip=true):

$ ./mvnw -B -ntp -DskipTests -P release verify -pl .
[INFO] --- gpg:3.2.7:sign (sign-artifacts) @ graphcompose ---
[INFO] BUILD SUCCESS

Sign step engaged but silently skipped via <skip>${gpg.skip}</skip>.

Forced (skip=false), no key:

$ ./mvnw -B -ntp -DskipTests -P release -Dgpg.skip=false verify -pl .
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-gpg-plugin:3.2.7:sign: Exit code: 2

Expected — confirms the plugin would actually attempt signing when the workflow flips the switch.

CHANGELOG entry added to v1.6.6 — Planned under ### Build.

What this doesn't do

• Does not wire up secrets. MAVEN_GPG_PRIVATE_KEY and MAVEN_GPG_PASSPHRASE are GitHub repo secrets the maintainer must create after generating the GPG key and uploading the public key to the keyserver pool. Until then, this PR is dormant — no publish workflow yet (Track D4), and the local default keeps everything green.
• Does not pick a key. The GPG plugin signs with whatever key the agent / gpg --homedir resolves; that policy lives outside the pom.

Pipeline state after this PR

Step	State
D1 — sources / javadoc jars + SCM	✅ shipped
D2 — GPG signing	🟢 this PR
D3 — central-publishing plugin	next
D4 — publish workflow	after D3

Maintainer GPG key generation and GitHub secret wiring is the human prerequisite before D4's workflow will actually publish anything; the plugin / workflow side will be ready and waiting.

Test plan

• Default mvn -P release verify green locally
• mvn -P release -Dgpg.skip=false verify correctly attempts signing (expected failure without key)
• No regression on default mvnw verify (no profile activation)
• CI green on PR (enforcer / japicmp / no-poi / guards / JDK matrix)
• Reviewer skim — the GPG plugin block (~30 LOC) and the <gpg.skip>true</gpg.skip> property are the load-bearing pieces