ci: Pin Maven to 3.9.16 with the Maven Wrapper

[liamhughes]

Background

Pre-release publishes have failed Maven Central validation since 7 October, when ubuntu-latest image ubuntu24/20261004.327 moved Maven from 3.9.16 to 3.10.0. central-publishing-maven-plugin 0.8.0 stages artifacts with Maven's install mechanism, and under 3.10 that also writes maven-metadata-local.xml and _remote.repositories into the staging folder. Both end up in central-bundle.zip, and Central rejects the bundle because the artifact folder has content without a .pom.

This is an alternative to #82, which pins the same version with a download step in the composite action. Here the pin lives in the Maven Wrapper, so local builds use the same Maven as CI and Renovate can see the pin.

The long-term fix (upgrading the plugin and removing the pin) is a follow-up on the ticket.

Part of BMBB-1251.

Changes

• Added the Maven Wrapper 3.3.4 (only-script, so no jar is committed), pinned to Maven 3.9.16 with distributionSha256Sum.
• Updated build-test-pack-deploy/action.yml to run ./mvnw instead of mvn, and added a Show Maven version step that logs ./mvnw -v.
• Added the maven-wrapper manager to renovate-config.js, with a rule holding org.apache.maven:apache-maven to <3.10.0.
• Updated CONTRIBUTING.md to use ./mvnw and dropped Maven from the prerequisites.

Notes for review

• The Renovate rule matters because a 3.10 bump would pass CI. Validation only happens at publish time, so the rule is the only thing stopping that PR from merging green.
• Renovate's maven-wrapper manager updates distributionSha256Sum along with the version, so the checksum shouldn't go stale on bumps.
• I haven't added a CI check for local-repository files in the bundle. It's still listed as a follow-up on the ticket.

Testing

• ./mvnw -v downloads and runs Maven 3.9.16, and a wrong distributionSha256Sum fails with a checksum error.
• ./mvnw -B clean deploy -Dgpg.skip=true locally: 433 tests pass, and the bundle has 20 files (CI's 24 minus the .asc signatures) with no maven-metadata-local.xml or _remote.repositories.