Add a manually triggered snapshot publish

[nedtwigg]

Follow-up to #3089 and #3090.

#3090 removed snapshot publishing from main, which also removed the only way to exercise the
publishing credentials and the signing key without cutting a release. Releases are immutable on
Central, so "try it and see" is not available there.

This adds a release-snapshot workflow that publishes a snapshot, on workflow_dispatch only. A
push to any branch still cannot publish anything.

• Runs in the maven-central environment, so the environment's branch policy decides where it can
  be dispatched from.
• Refuses to run unless every published module's version ends in -SNAPSHOT, so it can never ship a
  release by accident.
• Uses the new signing subkey 0xFA5C18CFB74EC7C6.

Note on where it can run. The environment currently allows only release, and that branch is
still at the pre-migration build, which has no publishToMavenCentral task. So dispatching there
will fail until a release happens — which is the thing this job is meant to de-risk. To use it
before the next release, main has to be added to the environment's branch policy. That is a
deliberate loosening, and it is worth being explicit about: what prevents a repeat of #3089 is that
nothing publishes automatically, nothing decodes a secret in CI, and the secrets are scoped to the
environment rather than the organization.

🤖 Generated with Claude Code

[jbduncan]

@nedtwigg Am I right to think that @edgartwigg is just another account of yours that was used for CODEOWNERS testing purposes in this case? :)

[nedtwigg]

With Codeowners, it is not possible to self-approve, so you need at least one other account. I keep the logins in separate systems, so it does add a tiny bit of security.

[jbduncan]

With Codeowners, it is not possible to self-approve, so you need at least one other account. I keep the logins in separate systems, so it does add a tiny bit of security.

That makes sense, thanks for confirming, my fears are assuaged. 👍