* Publish releases to the Code Genome Project instead of Maven Central

Bump `org.openrewrite.build.recipe-library` from 1.8.1 to `latest.release`,
which is what applies `org.openrewrite.build.publish-cgp`. That plugin needs
Groovy 4, so the Gradle wrapper moves from 8.14 to 9.7.0 to match the rest of
the org.

Disable the Sonatype repository and staging tasks so `publish` targets only
the `cgp` repository, while the shared publish workflow can keep invoking
`closeAndReleaseSonatypeStagingRepository`.

Forward the cgp_* publishing and resolution secrets in both workflows, and
rename ossrh_username/ossrh_token to sonatype_username/sonatype_token, which
is what the shared gh-automation workflows now declare. Also point ci.yml at
`master`, the repository's actual default branch, so CI runs at all.

* Keep publishing to Maven Central alongside the Code Genome Project

* Publish snapshots from master

ci-gradle.yml gates its snapshot step on `refs/heads/main`, so this repository
never published snapshots. Add a job that runs the same publish-snapshots
action on pushes to master, and opt out of the shared step so the two cannot
both fire if that condition is later broadened.

* Revert to the shared snapshot publishing now that the branch is main

The default branch was renamed from master to main, so ci-gradle.yml's own
snapshot step matches again and the repository-local job it needed is gone.