fix(FEL-623): guard unavailable Central retry

[codeyousef]

What changed

• handles the reviewed Sonatype status 404 without treating 404 itself as proof of failure
• binds the exception to the exact 0.6.0.0 deployment, old tag object/commit, reviewed repair baseline, and explicit acknowledgement
• proves all 75 intended coordinates remain absent from canonical Maven Central before retry
• atomically claims every failed-deployment retry with a per-run annotated tag before upload
• requires retry commits to remain contained in origin/main
• documents the fail-closed recovery and adds workflow contract coverage

Root cause

The corrected retry stopped before upload because Sonatype no longer exposes the original failed deployment ID. The existing workflow used curl fail-fast behavior and required a live FAILED status response. A simple 404 bypass would be unsafe and could allow duplicate uploads.

Impact

This permits one guarded replacement upload for the unpublished 0.6.0.0 bundle while preserving Maven immutability and duplicate-upload protections. Resume flows never claim or upload.

Verification

• npm test --prefix e2e-tests
• npm run typecheck --prefix e2e-tests
• /tmp/actionlint-1.7.12/actionlint .github/workflows/publish.yml
• ./gradlew help --no-daemon --stacktrace
• all 75 expected 0.6.0.0 POM coordinates confirmed HTTP 404
• known published 0.5.1.0 coordinate confirmed HTTP 200
• annotated-tag compare-and-swap rejection reproduced with two runners
• independent workflow/security review: no blocking findings