refactor: Use manifest declarations for Maven checks

[andrew]

Replace the custom POM parser and Maven Central client with declaration parsing from git-pkgs/manifests, the shared pin comparison path, and the injected enrichment resolver.

This follows git-pkgs/manifests#48 and builds on:

• Parse Maven build coordinates git-pkgs/pom#18, which exposes the POM structures needed by the manifest parser
• Expose source-level manifest declarations git-pkgs/manifests#67, which adds Maven declarations for parents, dependencies, plugins, plugin dependencies, extensions, management blocks, and profiles

The branch pins the manifests PR commit as a Go pseudo-version. Replace it with the next tagged manifests release before marking this ready.

Against main, the local arm64 binary grew from 11.32 MB to 11.43 MB. A 100-run no-op process benchmark moved from 6.84 ms to 7.43 ms per invocation.

[algomaster99]

Thanks for this PR! I see your manifest parser is nicer because of defaults such as org.apache.maven.plguins. I know it is in progress but we can merge when 56ea5fbc41be is in main.

Dropped a few nitpicks to minimize diff 😅

[Copilot]

Pull request overview

Refactors the Maven pom.xml checker to rely on git-pkgs/manifests declarations plus the shared pins diffing pipeline and an injected resolver.Resolver, removing the bespoke POM parser and Maven Central HTTP client.

Changes:

• Replace custom POM parsing and Maven Central metadata fetching with manifests.Parse + pins.Diff + injected resolver wiring.
• Update Maven unit tests to validate declaration extraction (including skipping property refs and handling exact range syntax) and to use a fake resolver.
• Wire the shared resolver into the Maven checker in main.go, and bump related Go module dependencies.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/maven/pom.go	Switch Maven checking to manifests declarations + shared pins diff + injected resolver.
pkg/maven/pom_test.go	Update tests for new declaration-based parsing and resolver injection.
pkg/maven/maven.go	Remove bespoke Maven Central HTTP resolver implementation.
main.go	Inject shared resolver into Maven checker.
main_test.go	Add test ensuring Maven checker receives the shared resolver.
go.mod	Bump git-pkgs/manifests and related deps.
go.sum	Update checksums for bumped dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[algomaster99]

@andrew ready to merge?

[andrew]

Yep!