chore: drop Composer/Packagist, Maven Central, and NuGet CLI publishing

[Mikola Lysenko (mikolalysenko)]

The CLI now publishes to GitHub releases, npm, PyPI, crates.io, and RubyGems only. This removes the Composer/Packagist, Maven Central, and NuGet cross-publishing flows — none of the three ever shipped in a tagged release (verified: no composer/, maven/, or nuget/ in the v3.1.0–v3.3.0 trees, and Packagist can't serve a version without a root composer.json at a tag). Patching support for the composer/maven/nuget ecosystems is completely unchanged — crawlers, hosted/vendor rewriters, fixtures, and e2e cells all stay.

What's removed

• composer/, maven/, nuget/ launcher packages and the root composer.json Packagist manifest
• release.yml: the packagist-publish, maven-central-publish, and nuget-publish jobs (all leaves — no needs: edges break) + header credential-matrix entries
• ci.yml lint-ecosystems: the PHP/Java/.NET launcher lint steps (job name unchanged, so branch protection is unaffected)
• scripts/version-sync.sh: the composer/maven/nuget stamp stanzas (release gate re-verified green: release-lint.sh --sync-only passes end-to-end)
• .gitattributes: the Packagist export-ignore allowlist — deliberate behavior change: GitHub's auto-generated "Source code" release archives and codeload tarballs are restored to full source (they were stripped to composer-only files)
• Self-update install-channel wording: the LauncherCache channel stays (the RubyGems launcher uses the same cache layout) but its upgrade hint is now gem update socket-patch (was "… or composer update …"); unit + e2e tests updated in the same commit (launcher_cache_refuses_with_gem_hint{,_windows})
• Docs: README install table, docs/installer-hosting.md, CLI_CONTRACT.md rows, and the CHANGELOG [Unreleased] entries that announced the never-shipped channels

Runbook

docs/releasing.md is rewritten as the full publish runbook: channel/auth table, bump → dispatch → npm 2FA approval → per-registry verification commands → mid-release failure recovery.

Ops follow-ups

None. The packagist/maven-central/nuget environments, their secrets, and the registry-side accounts (Packagist package, dev.socket namespace, nuget.org policy) were never set up, so there is nothing to clean up outside this repo.

Verification

• cargo test -p socket-patch-core --lib update — 129 passed
• cargo test -p socket-patch-cli --test self_update_channels_e2e launcher_cache — passed
• bash scripts/release-lint.sh --sync-only — version coherence green with the trimmed sync
• Both workflows YAML-parse; remaining release.yml jobs: version, build, tag, github-release, cargo-publish, npm-publish, pypi-publish, rubygems-publish
• Multi-agent audit + adversarial verify sweep over the full diff (residue greps, workflow graph, runbook operator walk)

🤖 Generated with Claude Code