fix(jvm): stop shipping the natives twice, and actually release Kotlin

Two separate problems, both visible from Maven Central.

The sources JAR was 50.70 MB against 0.18 MB of actual Java source.
`maven-source-plugin:jar-no-fork` sweeps `src/main/resources`, and the
release job stages the five platform JNI libraries there before
packaging — so every release uploaded 123 MB of binaries twice, once in
the fat JAR where they belong and once in a "sources" JAR that an IDE
opens to read `.java`. `excludeResources` ends that; nothing else lives
under `src/main/resources`, which is empty in git. Measured locally with
a staged native present: 3.1 MB fat JAR unchanged and still carrying it,
sources JAR 83 KB with zero native entries.

`fyi.oxide:pdf-oxide-kotlin` has never existed on Central. The publish
job has run and reported success since v0.3.69, but `automaticRelease =
false` leaves the deployment VALIDATED in the Portal for someone to
release by hand, and nobody ever has. Java has published automatically
since v0.3.56 and Scala does through sbt-ci-release; Kotlin was the one
JVM artifact still waiting on a click that never came. It now matches
them.

The workflow's own text claimed Java staged too — a leftover from before
v0.3.56 that had every reader believing a manual step was pending when
`waitUntil=published` already blocks until the version is live. Step
names and notices now say what the jobs do.

Claude-Session: https://claude.ai/code/session_01GpmgN5Mc14eRa1w4NCJrTy
Signed-off-by: Yury Fedoseev <yfedoseev@gmail.com>

Author: yfedoseev

.github/workflows/release.yml

@@ -702,7 +702,7 @@ jobs:
   # convention: the upload reaches VALIDATED state, then a human
   # flips the Publish button in the Central Portal UI.
   publish-maven:
-    name: Publish to Maven Central (staged)
+    name: Publish to Maven Central
     needs: [package-java-jar, create-release]
     runs-on: ubuntu-latest
     # Same convention as publish-npm / publish-pypi / publish-nuget:
@@ -741,24 +741,24 @@ jobs:
           path: java/src/main/resources/fyi/oxide/pdf/native/
           merge-multiple: true
 
-      - name: mvn deploy to Central Portal (autoPublish=false)
+      - name: mvn deploy to Central Portal (autoPublish=true)
         working-directory: java
         env:
           MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
           MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
         run: |
           # `release` profile turns on GPG signing + central-publishing-
-          # maven-plugin with `autoPublish=false` per pom.xml. The
-          # deployment reaches VALIDATED state in Central Portal; a
-          # maintainer flips "Publish" manually from the UI (matches
-          # feedback_release_gate — human gates the public publish).
+          # maven-plugin, configured in pom.xml with autoPublish=true and
+          # waitUntil=published: the step returns only once the version is
+          # live on Central, so a green job here means it is downloadable.
+          # The human gate is the tag, as it is for the other registries.
           mvn -B -P!dev -Prelease -DskipTests deploy
 
-      - name: Notice — Central Portal staging done
+      - name: Notice — published to Maven Central
         run: |
-          echo "::notice::Java JAR uploaded to Central Portal in VALIDATED state."
-          echo "::notice::Sign in at https://central.sonatype.com/ and flip Publish to release."
+          echo "::notice::Java JAR published to Maven Central (autoPublish, waitUntil=published)."
+          echo "::notice::Verify: https://repo1.maven.org/maven2/fyi/oxide/pdf-oxide/"
 
   # Package per-platform Go FFI tarballs as GitHub Release assets.
   #
@@ -2045,7 +2045,7 @@ jobs:
   # upload reaches VALIDATED and a maintainer flips Publish — same human
   # release-gate as publish-maven (Java).
   publish-kotlin:
-    name: Publish Kotlin to Maven Central (staged)
+    name: Publish Kotlin to Maven Central
     needs: [validate, create-release]
     runs-on: ubuntu-latest
     if: ${{ !contains(needs.validate.outputs.version, '-') && github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || inputs.publish) }}
@@ -2068,7 +2068,7 @@ jobs:
         working-directory: java
         run: mvn -q -B -P'!dev' -DskipTests install
 
-      - name: Publish to Maven Central Portal (VALIDATED; human flips Publish)
+      - name: Publish to Maven Central Portal
         working-directory: kotlin
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
@@ -2077,10 +2077,10 @@ jobs:
           ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
         run: gradle publishToMavenCentral --no-daemon --console=plain
 
-      - name: Notice — Central Portal staging done
+      - name: Notice — published to Maven Central
         run: |
-          echo "::notice::Kotlin artifact uploaded to Central Portal (VALIDATED)."
-          echo "::notice::Sign in at https://central.sonatype.com/ and flip Publish."
+          echo "::notice::Kotlin artifact published to Maven Central (automaticRelease)."
+          echo "::notice::Verify: https://repo1.maven.org/maven2/fyi/oxide/pdf-oxide-kotlin/"
 
   # Scala facade → Maven Central via sbt-ci-release (already in
   # scala/project/plugins.sbt). Credentials reuse the Java GPG/Sonatype

java/pom.xml

@@ -257,6 +257,19 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
                 <version>${maven.source.plugin.version}</version>
+                <configuration>
+                    <!-- `jar-no-fork` sweeps src/main/resources, and the
+                         release job stages the five platform JNI natives
+                         there before packaging. That put 123 MB of
+                         binaries (50 MB compressed) into a "sources" jar
+                         whose actual sources are 0.18 MB, and shipped
+                         them to Central twice per release — once in the
+                         fat JAR, where they belong, and once here. An IDE
+                         attaches a sources jar to read .java; nothing
+                         reads a .dylib out of one. Nothing else lives
+                         under src/main/resources: it is empty in git. -->
+                    <excludeResources>true</excludeResources>
+                </configuration>
                 <executions>
                     <execution>
                         <id>attach-sources</id>

kotlin/build.gradle.kts

@@ -62,11 +62,18 @@ tasks.test {
 // Maven Central publishing (Sonatype Central Portal). Credentials + signing key
 // come from CI env (ORG_GRADLE_PROJECT_mavenCentralUsername / *Password /
 // signingInMemoryKey / *Password), same secrets family as the Java binding.
-// GPG-signs all publications; autoPublish is left to the release-gate workflow.
-// The host argument is gone from the plugin: post-OSSRH there is only the
-// Central Portal, so `publishToMavenCentral()` targets it unconditionally.
+// GPG-signs all publications. The host argument is gone from the plugin:
+// post-OSSRH there is only the Central Portal, so `publishToMavenCentral()`
+// targets it unconditionally.
+//
+// `automaticRelease = true` matches the Java binding's `<autoPublish>true` and
+// every other registry this project publishes to. With `false`, the tag job
+// succeeded while leaving the deployment VALIDATED in the Portal for a human
+// to release by hand — and since v0.3.69 nobody ever did, so
+// `fyi.oxide:pdf-oxide-kotlin` has never existed on Central. The release gate
+// is the tag, not a second click.
 mavenPublishing {
-    publishToMavenCentral(automaticRelease = false)
+    publishToMavenCentral(automaticRelease = true)
     signAllPublications()
     coordinates("fyi.oxide", "pdf-oxide-kotlin", version.toString())
     pom {