fix(release): decouple shared api version from plugin releases

[alexk-dev]

Summary

• decouple shared extension-api and runtime-api dependency management from per-plugin ${project.version} bumps
• introduce a dedicated plugin.api.version repository property and validate it in scripts/plugins_repo.py
• document that shared repository APIs do not follow individual plugin SemVer releases

Root cause

release_main bumps an individual plugin version before building it. The parent pom.xml still managed golemcore-plugin-extension-api and golemcore-plugin-runtime-api with ${project.version}. After a plugin bump, Maven tried to resolve non-existent API artifacts like golemcore-plugin-extension-api:1.0.1, so the release build failed before publishing packages.

What changed

• parent dependencyManagement now pins shared API dependencies via plugin.api.version instead of ${project.version}
• repository validation now fails fast if shared API dependency management is re-coupled to plugin versions or if API module versions drift from plugin.api.version
• CONTRIBUTING.md now documents the independent shared API versioning rule

Verification

• python3 scripts/plugins_repo.py validate
• mvn -B -ntp -P strict verify
• mvn -B -ntp -P strict verify -pl extension-api,runtime-api,golemcore/telegram -am
• python3 scripts/plugins_repo.py release --plugin golemcore/telegram --bump patch
  • confirmed local release path now builds golemcore/telegram 1.0.1 successfully with extension-api and runtime-api included in the reactor