Fail the build when a documented JAR name drifts from the pom version

[dmccoystephenson]

Summary

• DocumentationVersionTest is added. It reads the top-level <version> from pom.xml, scans README.md, USER_GUIDE.md, CONFIG.md, COMMANDS.md and Dockerfile for every gh-backup-<version>.jar reference, and fails mvn test (so also mvn clean verify in the build CI job) with a file:line list of any reference naming a different version. A second test confirms the release workflow's target/gh-backup-*.jar glob is not matched.
• CHANGELOG.md is excluded on purpose, since it records the names of past artifacts (e.g. gh-backup-1.0.0.jar).
• CONTRIBUTING.md notes the check next to the existing testing instructions; CHANGELOG.md gains an [Unreleased] entry.

Of the three directions listed in #16, the first (a check that keeps the copy-pasteable literal names) was taken. It changes neither the artifact name, pom.xml, the release workflow, nor any workflow file, so the other two directions (<finalName>, placeholder names) remain open to the maintainer later. It is implemented as a JUnit test rather than a workflow step, so no .github/workflows/* change is needed and it also runs for anyone running mvn test locally.

The new test does not mirror a main-source class 1:1, because it guards repository files rather than a production class; it otherwise follows the test<Subject>_<Scenario> naming.

Closes #16

Skipped issues

• README links to a LICENSE file that does not exist #8 (missing LICENSE file): left open — choosing the copyright holder and year is a licensing decision flagged for the maintainer in the issue itself.

Test plan

• mvn test — 86 tests run, 0 failures, 1 skipped (pre-existing)
• Negative check: with README.md:21 temporarily changed to gh-backup-1.0.0.jar, DocumentationVersionTest failed with README.md:21 names gh-backup-1.0.0.jar; with the change reverted it passes
• CI build and docker-build jobs green

This PR description was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

🤖 Generated with Claude Code

---

drafted by Claude on behalf of Daniel Stephenson

[dmccoystephenson]

Self-review rubric (anchored on CI run 36230964635: build and docker-build both pass; the build log shows DocumentationVersionTest executed, Tests run: 2, Failures: 0, suite total 86 run / 0 failed / 1 skipped):

• Scope: PASS — three files changed (DocumentationVersionTest.java, CONTRIBUTING.md, CHANGELOG.md), each required for Hardcoded JAR version in docs and Dockerfile re-breaks on every version bump, with no CI check to catch it #16; no production code, pom.xml, or workflow touched.
• Tests-new: PASS — no new production methods; the guard itself is two tests, and the glob exclusion has its own case (testVersionedJarPattern_IgnoresGlob).
• Tests-fix: PASS (applied as a negative check, since this is a guard rather than a bug fix) — with README.md:21 set to gh-backup-1.0.0.jar the test failed with README.md:21 names gh-backup-1.0.0.jar; after reverting it passed.
• Sibling structure: PASS with a note — the test lives beside the other com.github.backup tests and uses the test<Subject>_<Scenario> naming, but it does not mirror a main-source class 1:1 because it guards repository files, not a class. This is stated in the PR body.
• Sibling renames: PASS — nothing renamed.
• Docs: PASS — no CLI flag, property, or endpoint changed, so README.md/COMMANDS.md/CONFIG.md/USER_GUIDE.md need no update; CONTRIBUTING.md documents the check and CHANGELOG.md [Unreleased] lists it.
• Issue resolution: PASS — Hardcoded JAR version in docs and Dockerfile re-breaks on every version bump, with no CI check to catch it #16 asks that a partial version-bump update become impossible to merge; mvn clean verify in the build job now fails on any mismatched reference in the five files the issue enumerates.
• CI: PASS — both jobs green on the PR head.
• Config-doc parity / Command-doc parity: PASS (not applicable) — no configuration keys, CLI flags, or endpoints added.
• Package placement: PASS — test-only change under src/test/java/com/github/backup/.
• No credential leakage: PASS — the test reads only pom.xml and documentation files.

Judgment call (not blocking):

• src/test/java/com/github/backup/DocumentationVersionTest.java:30 — the scanned files are an explicit list. A future doc (for example docker-compose.yml or .github/copilot-instructions.md, neither of which names the JAR today) that starts naming a versioned JAR would not be covered until it is added there. An explicit list was preferred over a repo-wide scan so that CHANGELOG.md's historical names and build output under target/ are not picked up by accident.

Summary: the guard is in place and verified both ways; ready to merge under the dispatch's merge authorization.

This review was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

---

drafted by Claude on behalf of Daniel Stephenson