Make the POM standalone: remove dependency on org.metricshub:oss-parent

[bertysentry]

Context

pom.xml currently inherits from org.metricshub:oss-parent:4. This coupling caused a subtle CI problem in #509: the parent's <reporting> section hard-pins older analysis-plugin versions (spotbugs-maven-plugin 4.9.3.0, maven-pmd-plugin 3.26.0), so mvn verify site ran the verify-phase SpotBugs check with 4.10.3.0 but then re-analyzed with the old 4.9.3 engine during site generation, overwriting target/spotbugsXml.xml with false US_USELESS_SUPPRESSION_ON_METHOD warnings that the GitHub annotations were built from. A local property override (spotbugs-maven-plugin.version) works around it, but the drift class remains: Dependabot only manages versions visible in jawk's own pom, not those injected by the parent.

Beyond the technical drift, jawk is a community project under the jawkio org with its own site (jawk.io), so it should not be coupled to MetricsHub's internal build parent.

Goal

Make pom.xml fully standalone: no <parent>, every plugin/config explicit in this repository, all versions managed by Dependabot here.

What jawk currently inherits from oss-parent (must be inlined)

• Maven Central publishing: central-publishing-maven-plugin, distributionManagement, release profile with maven-gpg-plugin signing
• Artifact attachment: maven-source-plugin and maven-javadoc-plugin (attach-sources / attach-javadocs)
• Release tooling: maven-release-plugin configuration (jgit SCM provider)
• Reproducible builds: maven-artifact-plugin buildinfo execution
• License headers: license-maven-plugin (check-license execution for the LGPL banners)
• Site: maven-site-plugin + sentry-maven-skin wiring, maven-project-info-reports-plugin, maven-jxr-plugin, maven-surefire-report-plugin, changelog config
• QA defaults: maven-enforcer-plugin, jacoco-maven-plugin, checkstyle/pmd/spotbugs reporting section
• Misc: encoding properties, maven-deploy-plugin skip for pom packaging, assembly/shade/compiler/surefire/failsafe pluginManagement defaults

Suggested approach

1. Generate the baseline with mvn help:effective-pom on the current build to capture everything actually in effect.
2. Copy the needed sections into pom.xml, dropping anything MetricsHub-specific or unused by jawk.
3. Remove the <parent> block; keep spotbugs-maven-plugin.version-style properties so build and reporting sections stay in sync (see build(deps-dev): bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.8.3 to 4.10.3.0 #509).
4. Verify no behavior change: mvn verify site locally and in CI, diff the produced artifacts (jar, sources, javadoc, buildinfo) and the generated site against a build from main.
5. Validate the release pipeline with a snapshot deploy to Central Portal before the next release — a broken deployment discovered at release time is the expensive failure mode.

Risks

• Getting Maven Central publishing (signing, checksums, buildinfo, portal upload) exactly right; it works today via the parent.
• Fixes made in oss-parent for other MetricsHub projects will no longer reach jawk — all build maintenance becomes local to this repo (which is the point, but it's a trade-off worth stating).

🤖 Generated with Claude Code