feat(bom): add falco-bom, a platform pinning the published modules

[TheMeinerLP]

Proposed changes

The three published modules are built and released together and only ever make sense in the same
version, but a consumer had to repeat that version on every dependency line and was free to get it
wrong. falco-bom is a java-platform project whose only product is a POM with a
dependencyManagement block, so the version is declared once as a platform:

dependencies {
    implementation(platform("net.onelitefeather", "falco-bom", "0.3.1-SNAPSHOT"))
    implementation("net.onelitefeather:falco-anvil")
    implementation("net.onelitefeather:falco-light")
    implementation("net.onelitefeather:falco-instance")
}

It pins its siblings by project reference rather than by coordinate string, so Gradle reads the
version off the module itself instead of asking someone to keep a literal in sync on every release.
The single line Release Please rewrites stays the only place a version number is written.

Two consequences for the root build, both of which are the actual substance of this change:

• java-library and java-platform are mutually exclusive plugins, so the block that configures
  the Java modules now runs over subprojects - project(":falco-bom"). group and version stay
  on all subprojects, because the BOM needs its own version to be right for the project references
  above to resolve to the correct numbers.
• java-platform is applied to falco-bom from the root script, not from the module's own. A
  subproject's build script only runs after the root one, so a plugin applied there would leave the
  javaPlatform software component unregistered by the time the publishing block further down the
  root script reaches for it.

The publishing setup is split accordingly: one shared block configures the repository, credentials
and the release/snapshot switch for all four published modules, and two component-specific blocks
publish components["java"] with sources and javadoc jars for the libraries, and
components["javaPlatform"] for the BOM, which has nothing to compile or document.

Why the README uses a snapshot coordinate

The BOM was added after 0.3.0 was cut, so the release endpoint does not serve it and won't —
falco-bom:0.3.0 returns 404 and always will. Until the first release that contains it, the README
writes the coordinate in the three-argument form, which is the same device this project already used
for falco-instance before it had a release: the Renovate rule that rewrites group:name:version
coordinates to the latest release deliberately does not match it, so the snippet cannot be pointed at
a version that does not exist. From the next release on it becomes a normal coordinate and both the
snapshot version and the comment explaining it should go.

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Performance change (behaviour unchanged, cost changed)
• Documentation Update (if none of the other choices apply)

Checklist

• I have read the CONTRIBUTING.md
• The title of this pull request is a Conventional Commit — note it introduces a new scope,
  (bom), alongside the (anvil) / (light) / (instance) / (map) the template lists. It
  follows the same convention of naming the module it touches.
• I have added tests — not applicable, and deliberately so: a java-platform project has no
  sources and no runtime behaviour to test. What it produces is a POM, and that is verified by
  generating it (see below) rather than by a test class.
• Tests are package-private, named test<What><Expectation> — no tests added, see above.
• Javadoc on every new class and method — no classes or methods added; the build file carries
  prose comments in the style of the surrounding build scripts instead.
• I have not written @NotNull; the package @NotNullByDefault covers it
• ./gradlew build is green locally
• I have added necessary documentation (if appropriate) — the Using it section of the README

Verification

./gradlew :falco-bom:generatePomFileForMavenPublication produces exactly the dependencyManagement
block the change exists for:

<dependencyManagement>
  <dependencies>
    <dependency><groupId>net.onelitefeather</groupId><artifactId>falco-anvil</artifactId><version>0.3.0</version></dependency>
    <dependency><groupId>net.onelitefeather</groupId><artifactId>falco-light</artifactId><version>0.3.0</version></dependency>
    <dependency><groupId>net.onelitefeather</groupId><artifactId>falco-instance</artifactId><version>0.3.0</version></dependency>
  </dependencies>
</dependencyManagement>

• ./gradlew clean build — green, existing modules and their tests unaffected by the subprojects
  restructure.
• ./gradlew publishToMavenLocal — ~/.m2/repository/net/onelitefeather/falco-bom/0.3.0/ contains
  falco-bom-0.3.0.pom and falco-bom-0.3.0.module.
• The Renovate rule was checked against the new README: it matches the five release coordinates and
  leaves the BOM's three-argument snapshot line alone, which is the intended behaviour described
  above.

Further comments

Nothing in .github/workflows needed changing — there are no per-module path filters or publish
lists; publish runs at the root and now covers four modules instead of three.

STATUS.md and docs/ were left alone on purpose. Their module tables describe compiled types and
test counts, and a platform module has neither, so a row there would be noise rather than signal.

Out of scope, but worth recording: the Snapshots, Maven and API documentation subsections of
the README still carry hardcoded 0.2.1 / 0.2.2-SNAPSHOT examples and a "no release yet" note for
falco-instance that 0.3.0 already made false. Those were stale before this change and fixing them
means verifying live javadoc URLs, so they are left for a separate documentation pass.

🤖 Generated with Claude Code

[github-actions]

Test results

  153 files    153 suites   2m 50s ⏱️
  554 tests   554 ✅ 0 💤 0 ❌
1 671 runs  1 671 ✅ 0 💤 0 ❌

Results for commit fdb0853.

♻️ This comment has been updated with latest results.