Publish GraphCompose to Maven Central (Sonatype OSSRH + GPG signing)

[DemchaAV]

Goal. Make GraphCompose available via Maven Central as the primary distribution channel; keep JitPack as a documented fallback.

Why. JitPack is a fast, low-friction default for early releases, but for a Java library targeting production server-side adoption, Maven Central is the authoritative registry: it ships with every build agent, requires no additional <repository> declaration, and signals stability + maturity to Java decision makers.

Coordinates target. From v1.7 onward, the canonical install snippet becomes:

```xml

io.github.demchaav
graphcompose
1.7.0

```

(Note the group-id flip from `com.github.DemchaAV` (JitPack convention) to `io.github.demchaav` (Sonatype namespace). The `groupId` field in the POM already points there.)

Scope.

• Sonatype OSSRH account + namespace ownership for `io.github.demchaav`
• GPG signing key generated, distributed to public keyserver, and configured in CI secrets
• `pom.xml` extended with `distributionManagement`, `maven-source-plugin`, `maven-javadoc-plugin`, `maven-gpg-plugin`
• CI workflow that triggers on tag push (`v*..`) and runs `mvn deploy -Prelease` against OSSRH staging
• Staging-repo close + release automated via the `nexus-staging-maven-plugin`
• README install snippet flips to Maven Central coordinates; JitPack snippet kept as a "fallback" subsection
• First Maven Central release tagged as v1.7.0; JitPack continues to mirror the same tag

Out of scope.

• Migrating prior tags (v1.0 - v1.6) to Maven Central. Only v1.7+ ships there.

Tracking. Linked to milestone v1.7. CHANGELOG already lists Maven Central as a v1.7 stretch goal under "Phase E".