Modernize build policy and verify release artifacts

[jmanico]

The build inherited an obsolete OSS parent and dormant Site/report stack, had no shared tool/plugin policy, and collected coverage without enforcing it. This change replaces those paths with a verified Maven wrapper, explicit lifecycle pins, build-bound source/coverage checks, and isolated release tooling.

• Retire legacy Site/Reflow/reporting and oss-parent:9; preserve unique usage examples, attached source/Javadoc artifacts, public Pages and consumer identities/scopes.
• Pin Wrapper 3.3.4/Maven 3.9.16, distribution SHA-256 and strict transfer checksums. Gate Unix/Windows bootstrap and wrong-checksum rejection. Enforce build/dependency/plugin rules while retaining Java 8 forked tests and advisory newer JDK builds.
• Enforce measured coverage floors and useful main-source/header checks with preserved attribution. Document the Java 17 Checkstyle engine compatibility exception and descriptor parser exclusion.
• Use GPG 3.2.8/Central 0.11.0 in the release profile only, with reviewed plugin-only Jackson/HTTP fixes, exact Temurin 17.0.20.1+1/Maven release constraints, autoPublish=false, and optional WAR exclusion. A local assembler verifies all 17 signatures against an expected full fingerprint before creating the 102-entry bundle; it never uploads.
• Add deterministic archive/bnd inputs and a two-directory/two-repository comparison. Archive authenticated 1.2.2–1.4.0 public keys and tested consumer verification instructions. Four earlier authorization-record gaps remain explicitly open in Complete historical release-key records and verify consumer instructions #110; the current project key is unchanged.

Validation: full reference-JDK verify (2,178 unit tests, eight existing integration tests, both packaged JSP engines), 17 artifact guards, parity, and Java 17 isolated consumers passed. Real lost test coverage was rejected; coverage-skipped verify passed. All 17 unsigned artifacts from two fresh builds of 8b548244233330872ba2c6d165f7624b5e6cddff were byte-identical. Isolated signing with a disposable test key produced 17 verified signatures; bundle verification, tamper/wrong-key/stale-POM probes, and noninteractive missing-key/SNAPSHOT release failures passed. Four optimized-mode regression tests protect against Python removing acceptance checks; all 14 policy/verification tests pass.

All 28 checks passed at the initial implementation head, including Windows/Unix wrapper, browser/WAR, ten ESAPI versions, Java 8 unit JVM and original-JAR runtimes 8/11/17/21/25. Sol final review and Astra final pass found no remaining actionable findings on 8d761d5c886455830dde0fc4600fc3747ddd5350. Astra independently reran all 14 policy/verification tests, compared the 17 retained artifact hashes and verified both wrapper scripts against the upstream archive. All 28 checks passed on that final head before merge. Sol found the optimization-sensitive assertions and an inaccurate migrated Central example; both were fixed. AI review is not independent maintainer approval. Detailed evidence and limitations: releases/batch-04-validation.md.

Central 0.11.0's skipPublishing filters artifacts instead of producing the ZIP suggested by upstream docs; the verified local assembler handles this explicitly. No production key/token, upload, release tag or 1.5 publication was used. #111 retains namespace access, independent custody and the real validated-and-dropped staging rehearsal.

Closes #96. Closes #104. Closes #122. Closes #95. Closes #124. Closes #125. Closes #103.
Progresses #110 and batch 04 of #169.