ci: mirror current Kuikly KBA predecessors

[bytemain]

Summary

• freeze the current combined OHOS predecessor closure at 5 GAV / 25 canonical Tencent Maven primaries
• exclude the unused kotlinx-coroutines-core:1.8.0-KBA-001 and dotted atomicfu:0.23.2.KBA-001 historical families
• add a standard immutable Maven publisher using one repository-scoped RAFT_ARTIFACTS_PUBLISH_TOKEN
• classify destination state as all-absent, complete-exact, resumable-partial, or conflict; exact bytes skip, missing bytes upload, mismatched bytes stop
• bind manual publication to the exact live staging3 head and the protected raft-artifacts-production environment

Current machine receipt

• authority bytes: 25/25 size + SHA-256 verified
• public Raft destination: 25/25 HTTP 404
• local tests: 5/5 PASS
• actionlint: PASS
• diff-check/DCO: PASS

Boundaries

This PR only adds source + Hosted validation and the ordinary Maven publication workflow. It does not publish packages, create a release marker, cut over consumers, or modify KuiklyUI product code. Exact source review and Hosted must pass before ordinary landing; publication is a separate manual dispatch on the actual landed SHA.

Task: #121