ci: publish validated Central candidates through protected approval

[ChoMinGi]

What changed

Add a manually dispatched final publication step for an existing Central candidate, using the protected central-validation environment and its existing credentials. The workflow builds and uploads nothing. It verifies the signed release tag, main ancestry, successful upload run containing the specified deployment ID, and a successful sustained-load run for the exact release commit before exposing credentials.

It checks the Central deployment name and expected Maven coordinates, publishes only VALIDATED, and can resume polling PUBLISHING/PUBLISHED without uploading a duplicate. Cross-origin redirects are refused. Public consumer resolution and GitHub draft publication remain separate final checks.

Testing

• actionlint and whitespace checks passed.
• Embedded Python parsed and exercised with mocked Central responses: validated publication, already-published retry, wrong coordinates, wrong deployment name and failed state.
• This changes workflow/runbook only; the 0.2.2 signed release artifact remains on bef979f.

Checklist

• Workflow syntax and publication-state transitions checked
• No rebuilding or duplicate upload path
• Existing environment approval retained
• No credentials or captured model data included