fix(ci): build the Maven extension jar outside the Socket Firewall shims

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

Summary

The release build failed at the Maven-extension jar step. Root cause: pnpm run build:maven-extension runs the whole build subtree (pnpm → bash → mvnw → wget) under Socket Firewall, which intercepts by shimming the package managers it wraps (npm/yarn/pnpm/pip/uv/cargo). sfw then proxies the Maven wrapper's download of Maven from Maven Central and fails on that non-package fetch.

The fix is a one-line change: invoke build-jar.sh directly rather than through pnpm run. bash/mvnw/wget aren't shimmed, so the Maven download runs outside the sfw-wrapped process tree and succeeds. The jar stays uncommitted and is still bundled into dist/manifest-scripts at build time.

Relationship to #1387

This is the lighter-touch alternative to #1387 (which commits the prebuilt jar). Preference is to land this if it builds green in the release, and keep #1387 as the fallback if the direct invocation still trips the firewall.

---

Note

Low Risk
Single workflow-step change with no runtime or auth impact; only affects how the release job builds an uncommitted jar.

Overview
Fixes release CI failures when building the Maven manifest extension jar by invoking build-jar.sh with bash instead of pnpm run build:maven-extension.

In the publish workflow, Socket Firewall shims pnpm, so the previous path nested mvnw/Maven Central downloads under sfw and broke on non-package fetches. Direct bash keeps that download outside the shimmed package-manager tree; JDK selection via JAVA_HOME_17_X64 is unchanged, and the jar still bundles into dist/manifest-scripts for publish.

^{Reviewed by Cursor Bugbot for commit 59f7e2a. Configure here.}