feat: improve graph publisher workflows

[imbajin]

Update Server and Toolchain publishing for 1.8.0/Java 17. Build-only runs use public settings without keys; Maven and SVN uploads remain independently selected. All four component publishers default to version 1.8.0 and source ref release-1.8.0; Computer defaults to Java 17, retaining Java 11 as an explicit option for older source. These upstream release branches must be prepared from reviewed SHAs before using the defaults; rehearsals explicitly select a SHA or master.

Reuse each source repository's apache-release.sh for SVN packaging, signing, hashing and upload. Detach at the checked-out SHA before binding its local release branch; no remote branch is created. Candidate uploads use the native version directory. Post-vote migration still accepts existing RC paths and atomically handles KEYS and optional old-version deletion.

One small Maven checker replaces duplicated version/target/settings checks. Existing AI metadata and Toolchain settings manipulation have been moved from inline Python to two small scripts, with no added dependencies; SVN migration now has readable sections and comments. Toolchain consumes a selected Apache SDK staging repository in an isolated local repository, reusing the existing Apache server ID for authenticated upload runs. Full-reactor deployment stays per module (deployAtEnd=false) to avoid deploy plugin 2.8.2's false-success deferred queue behavior with build extensions.

Full candidate acceptance remains in Doc #512: signatures, licensing, archive rebuilds and runtime integration. The independent Publisher CI checks workflow only tests publisher syntax, local Maven deployment and atomic local SVN migration; publishing never calls it. The unused legacy candidate validator and empty outdated workflow were removed.

Validation:

• Latest readability/defaults revision 6d1cff0: Publisher checks, AI archive and Toolchain staged SDK build have uploads disabled. Publisher checks and AI archive pass; Toolchain staging configuration and all ten SDK origin checks pass, with the full build still running. Local actionlint, shellcheck, Python compilation, three SVN regressions, and AI metadata/settings/origin-key fixtures pass; independent review found no behavioral regressions.

• Publisher CI passes on 34b0257: actionlint, shellcheck, four local Maven/SVN publisher regressions. SDK resolution explicitly checks JAR and POM origins for all five coordinates; seven guard replay cases cover accepted and rejected origins. The real anonymous Toolchain build also passed all ten staging-origin checks and full binary packaging with both upload switches off. The POM-origin review thread is resolved.

• All four upstream release scripts passed a separate disposable-key/local-SVN rehearsal using fixture source/binary inputs: signed archives and 18 candidate files, including a source checkout already on the release branch. No Apache SVN writes. This rehearsal adds no test framework to the PR.

• Actual Maven mirror authentication and origin checks passed against a temporary local HTTP repository using fixture credentials; public settings could not authenticate, as expected.

• Refreshed Server public build, Computer default build and JDK input, and AI default archive pass. The Server workflow is unchanged since its tested revision; the only later AI code change permits safe set +x.

• The signed Server staging rehearsal deployed 38 module directories to orgapachehugegraph-1160. After explicit approval, close-only verification confirmed closed state and anonymously readable core JAR bytes matching the original build SHA512. No promote/release or Apache SVN write.

• The Toolchain staging run uses source e669922, including the merged offline Loader API. Five selected-repository SDK resolutions and effective deployment target checks passed. The signed full-reactor upload and binary artifact save passed; read-only inspection confirms all nine Toolchain module directories in orgapachehugegraph-1161. After explicit dependency-chain approval, close-only verification confirmed anonymous Client/Loader 1.8.0 JAR/POM access, checksums and the staged offline Loader API; the staging group is now readable for Computer CI. No promote/release or Apache SVN upload. Earlier attempts that failed provenance checks before deployment are not counted as uploads.

• AI 1.8.0 unsigned archive entrypoint passes with merged source 7729a1e, upload disabled, and workflow head 55b378a. The merged AI main also passes Client and LLM runtime CI against Server 1.7.0 and actual Server 1.8.0 (latest).

• Post-merge publisher entrypoints pass against Computer 35e2949 (1.8.0/Java 17) and AI 8a7c186 (unsigned source archive), with uploads disabled. Product integration remains in the component repositories: the merged Computer CI, AI Client CI and AI LLM CI pass against the release and latest Server baselines.

• Independent Computer source-archive testing found that existing export rules omitted binary-license inputs. Computer #364 corrects that rule and adds a small archive contract check in Computer CI; full source rebuilds restore the bundled legal files. The fix is tracked in Computer; its final head f7fda23 passes the archive/license gates, both Server runtime matrices and CodeQL. It is merged as 35e2949; post-merge master runtime CI and the nocode public build both pass. This does not extend nocode into candidate acceptance.

The release guide is kept at .github/workflows/release.md, without adding a docs or ci directory or changing README. Default upload flags and existing Secret names are unchanged.

Publisher CI overview (English)