ci: never let the dependency-submission step withhold the GitHub assets

The release pipeline is deliberately built so the GitHub assets land even when
the Central publish fails: github-snapshot / github-release run on
`publish-*.result == 'success' || == 'failure'`, with a comment saying so --
a Central publish-poll timeout must not lose the pre-release assets.

That guarantee has a hole upstream of it. The dependency-submission step sits
in the `report` job unguarded, and `report` gates the whole chain:

  report FAILS
    -> check-snapshot        SKIPPED  (failed need; its if: is a plain
                                       event/ref condition, no always())
      -> publish-snapshot    SKIPPED  (if: check-snapshot.result == 'success')
        -> github-snapshot   does NOT run -- its if: tolerates 'failure' but
                             'skipped' matches neither arm

So a third-party informational action having a bad day does not merely delay a
Central publish: it silently defeats the one thing the pipeline goes out of its
way to guarantee. The action submits the dependency graph to GitHub; it says
nothing about whether the artifacts are correct, so it has no business gating
anything.

srcmorph already had this guard -- added in passing by ee2ae49 ("report unsigned
assets without ever withholding them"), a commit whose *feature* was ported here
as a single clean change that reproduced the feature and not the drive-by line.
The three repos are now textually identical to srcmorph at that step (same
comment, same flag; the 5-line block hashes equal in all four).

Note what stays bare, on purpose: checkout and setup-java are infrastructure,
and streambuffer's PIT steps are gates, not reports. The convention this
restores is narrower -- informational third-party steps do not block -- and the
submission action was the only step in `report` violating it, sitting between a
guarded download-artifact above and guarded Coveralls/Codecov below.

Verified: the four publish.yml files still parse, `report` still has exactly one
submission step, and it now carries continue-on-error in all four.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH

Author: claude

.github/workflows/publish.yml

@@ -3356,7 +3356,11 @@ jobs:
       - uses: actions/download-artifact@v8
         with: { name: jacoco-report, path: target/site/jacoco/ }
         continue-on-error: true
+      # Submits the dependency graph to GitHub. Informational: it says nothing about whether the
+      # artifacts are correct, but it sits in the `report` job, which the release path needs -- so
+      # without this flag a third-party action having a bad day can block a publish.
       - uses: advanced-security/maven-dependency-submission-action@v6
+        continue-on-error: true
       - name: Coveralls
         uses: coverallsapp/github-action@v2
         with: