Fix remote signing and dependency publication

[kvz]

Android SDK 0.2.0 could load without its Java SDK, tus, or WorkManager dependencies, and a backend that signs only Assembly creation could make completed work fail.

The library did not apply maven-publish or configure AGP's release component. Its root publication attached the AAR manually, without dependency metadata. Assembly status reads used the Java SDK's generic signed GET, including the final read after SSE completion, so a creation-only signing backend rejected them.

• Publish the library's release component, preserve source/Javadoc artifacts, and verify the generated POM's dependencies, versions, scopes, packaging, and single AAR in check. Expose the Java SDK and WorkManager as API dependencies because their types appear in the public API.
• Fetch the returned assembly_ssl_url directly without invoking SignatureProvider, preserving the client header, relative URL handling, and configured request retries. Handle terminal initial responses without waiting for an SSE callback and retain available identifiers in failure output.
• Use the signing endpoint in the README's WorkManager example and make all signing examples use the worker's JSON response format. Correct signing's introduction version to Java SDK 2.1.0; explain the Android SDK's 2.2.4 dependency for SSE handling.

Validation:

Regression	Red before its fix	Green
verifyPublishedPom	Expected six declared dependencies; got []	Generated POM declares the expected API/runtime dependencies and one AAR
Creation-only provider polling	Failed to generate signature using provider	Two status GETs; only Assembly creation calls the provider
WorkManager completion	Failure, with two signing requests	Success, with one signing request and a direct status GET
Already completed creation	Retry	Success
Aborted/canceled/error creation	Three tests returned Retry	Three tests return Failure immediately
Relative status URL and failure identifiers	Relative URL threw IllegalArgumentException; failed work lost its identifiers	Relative GET works without signing; failure output retains available identifiers

Commands run locally with live API tests disabled:

./gradlew :transloadit-android:verifyPublishedPom
./gradlew :transloadit-android:testDebugUnitTest --tests com.transloadit.android.sdk.RemoteSigningStatusTest
./gradlew assemble check :transloadit-android:generateMetadataFileForAndroidReleasePublication :transloadit-android:sourcesJar :transloadit-android:javadocJar

The POM check, all seven regression tests, debug/release unit tests, lint, and publication artifact generation pass. Red and green logs are retained locally. Live API tests were skipped; publication and device behavior were not exercised. These fixes need a new release to replace the published 0.2.0 artifact.

Fixes #23

Final council review:

The final council round covered the complete committed PR diff 70601ab65dee28e9ecdf4f7df2b9fb9f411c4be6...b89ab7ceda176d5cb06bab3b6bacfd715aff304b, including all code, publication configuration, tests, and README changes at b89ab7c. Consolidated report: build/repro/council-final-pr-review.log.

Result: one P3 finding, fixed in 4ef55ba. The README's signing example read only the first response line; it now reads the complete JSON body and closes the reader reliably.

Red/green evidence: compiled the literal README provider against Java SDK 2.2.4 and exercised it against a local HTTP fixture. Compact JSON worked, but multiline JSON failed with JSONObject text must end with '}'. After the fix, both response formats pass. The reproduction and logs are retained locally under build/repro/check-readme-response.py, red-readme-response.log, and green-readme-response.log. ./gradlew check also passes after the fix.

No open review items for Tim. No further council rounds were started after this final round; its fix was verified locally.