Fix BOM consumer POM publication

[remdui]

Summary

• configure flatten-maven-plugin with updatePomFile=true while retaining resolveCiFriendliesOnly
• add an external-consumer regression check that installs the parent/BOM into a fresh local Maven repository
• assert the installed parent and BOM POMs contain no unresolved ${revision} placeholders
• build a standalone temporary Maven consumer that imports featureframework-bom and verifies it supplies the featureframework-theme-api version
• run the consumer check in normal CI and before tagged release deployment

Why

featureframework-bom and featureframework-parent both use pom packaging and CI-friendly ${revision} versions. The Flatten plugin was generating flattened POMs, but without updatePomFile=true a POM-packaging project is not guaranteed to use that flattened POM for install/deploy. That can leave downstream consumers with a published POM whose parent/version still contains ${revision}.

This matters now that ServerFeatures and ProxyFeatures are moving to application-level FeatureFramework BOM imports for strict dependency convergence.

Validation strategy

The new scripts/verify-bom-consumer.sh tests the artifact exactly at the Maven consumer boundary rather than only inspecting source configuration:

1. resolve the current FeatureFramework version;
2. install featureframework-parent and featureframework-bom into a fresh temporary Maven local repository;
3. reject either installed POM if it still contains a literal ${revision};
4. create a standalone Maven project outside the reactor;
5. import featureframework-bom at the current version and declare featureframework-theme-api without a version;
6. generate the consumer effective POM and assert the dependency is managed to the FeatureFramework platform version.

The release workflow runs this gate before the deploy step, preventing a future tag from publishing an unusable BOM unnoticed.

Compatibility

No runtime Java/API behavior changes. This only changes Maven publication metadata and release validation.

Validation

• branch is based directly on current main (483e894994766dd73200845a55439025144fb879)
• exact diff is limited to the parent POM, consumer-validation script, and CI/release hooks
• bash -n passes for the new script
• CI Checkstyle passes across the complete 17-project reactor
• CI ShellCheck passes on the current PR head
• Java 25 Maven Verify passed on the immediately preceding head
• the new external BOM consumer test passed on that same head, proving the installed parent/BOM POMs contain resolved versions and a standalone consumer can import the BOM and receive featureframework-theme-api:1.5.1
• the only change after that successful Maven/consumer run was the ShellCheck-safe spelling of the literal ${revision} probe
• current-head Maven Verify and Paper/Velocity platform acceptance are running

The PR remains draft until the current-head runtime gates complete.