Make productionCheck and release publication genuinely fail-closed

[hemju]

Impact

The documented productionCheck does not execute most module tests, and the tag-triggered release workflow publishes without running either check or productionCheck. A mistyped v* tag can therefore publish an unverified build automatically.

Evidence

The root task depends on root clean and root check, not each subproject task. A dry-run omits core, memory, Spring, metrics, tracing, dashboard, and UI tests. Root clean also leaves subproject outputs intact. .github/workflows/release.yml invokes only publishAggregationToCentralPortal and does not compare the tag to the Gradle version.

Acceptance criteria

• productionCheck cleans and checks every subproject from a genuinely clean graph.
• Release publication depends on the complete production gate.
• Tag vX must exactly match project version X.
• Publish the already-verified artifacts rather than rebuilding an unchecked graph.
• Add a build-logic regression/TestKit assertion for the production task graph.