ci: require Connect platform JARs in release verification

[robinbraemer]

Intent

Tighten connect-java release.yml published-asset verification so it can only pass when a real Connect platform plugin JAR landed, using the same positive ^connect-(spigot|velocity|bungee).*.jar$ allowlist already proven in release-repair.yml. Preserve executable fail-before/pass-after regression coverage for the source.tar.gz false-positive case and keep release workflow documentation accurate. Treat plugin release, hub image rebuild, Gate release, Moxy consumption, deployment, production rollout, and merging as separate out-of-scope decisions; this change must not perform or alter any of them.

What Changed

• Tightened published-release verification to require a non-empty uploaded Connect platform JAR, using the positive allowlist shared with release-repair.yml.
• Added executable regression coverage proving source.tar.gz fails while a real plugin JAR passes.
• Updated AGENTS.md to document the strengthened verification contract.

Risk Assessment

✅ Low: The patch is narrowly scoped, uses the requested positive plugin-JAR allowlist, preserves the regression guard, and the prior documentation issue is corrected.

Testing

Focused validation confirmed source.tar.gz is rejected, valid Connect platform JARs are accepted, the allowlists match, and documentation is accurate. Transient build outputs were removed.

Evidence: Release asset guard fixture evidence

source-only fixture: source.tar.gz
legacy broad BUILD_COUNT=1 guard_exit=0 (false positive)
strict BUILD_COUNT=0 guard_exit=1 (rejected)
valid plugin fixture: connect-velocity.jar
strict BUILD_COUNT=1 guard_exit=0 (accepted)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• ⚠️ .github/workflows/release.yml:160 - The intent requires “keep release workflow documentation accurate,” but this changed comment still describes a “metadata blacklist” even though BUILD_FILTER is now a positive allowlist. Update it (and the adjacent failure message) to describe any non-matching asset, including source.tar.gz.

🔧 Fix: Corrected positive plugin-JAR allowlist documentation
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• ./gradlew :core:test --tests com.minekube.connect.release.ReleaseAssetVerificationTest
• ./gradlew :core:test --tests com.minekube.connect.release.ReleaseAssetVerificationTest --tests com.minekube.connect.release.ReleaseRepairCapabilityTest
• Direct JQ/bash fixture exercising the release workflow filter
• Exact BUILD_FILTER comparison between release.yml and release-repair.yml
• Updated AGENTS.md documentation assertion

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.