Release workflows: use ASF org-shared Nexus deployer secret names - #3776

The 2026-09-16 Cancel RC run for 1.19.0 rc9 failed with HTTP 401 because
release-cancel-rc.yml still read secrets.PARQUET_NEXUS_USER /
PARQUET_NEXUS_PASSWORD, which do not exist on apache/parquet-java. apache#3776
moved prepare-rc and publish to the ASF org-shared
NEXUS_STAGE_DEPLOYER_USER / NEXUS_STAGE_DEPLOYER_PW but missed cancel-rc,
the last two references in the tree. Nothing was cancelled: verification
is step 0, so the run aborted before dropping the staging repo or deleting
the SVN artifacts.

An absent secret expands to the empty string rather than failing, so the
credentials were present-but-blank and the first authenticated curl
reported only "error: 401". Add require_env and call it from all three
release scripts when DRY_RUN is not 1, so a missing credential is named
before any network call. Dry runs stay usable without secrets because
every authenticated call is already gated on DRY_RUN. _maven.sh had this
check for the deploy path only, which is why prepare-rc's Nexus 401 was
equally opaque.

Also apply apache#3787's tag-push ordering to publish-release.sh. It pushed the
final tag in step 3 and released the staging repo in step 4, so a Nexus
failure left a published release tag and the "Final release tag already
exists" guard then blocked the retry -- the same trap apache#3787 removed from
prepare-rc, where eight orphaned 1.19.0 RC tags accumulated. Keep git tag
-a in step 3 for the local reads that follow and move only the push to
step 5, immediately before the GitHub release that needs it on the remote.

Generated-by: Claude Opus 5 (1M context)

…3814)

The 2026-09-16 Cancel RC run for 1.19.0 rc9 failed with HTTP 401 because
release-cancel-rc.yml still read secrets.PARQUET_NEXUS_USER /
PARQUET_NEXUS_PASSWORD, which do not exist on apache/parquet-java. #3776
moved prepare-rc and publish to the ASF org-shared
NEXUS_STAGE_DEPLOYER_USER / NEXUS_STAGE_DEPLOYER_PW but missed cancel-rc,
the last two references in the tree. Nothing was cancelled: verification
is step 0, so the run aborted before dropping the staging repo or deleting
the SVN artifacts.

An absent secret expands to the empty string rather than failing, so the
credentials were present-but-blank and the first authenticated curl
reported only "error: 401". Add require_env and call it from all three
release scripts when DRY_RUN is not 1, so a missing credential is named
before any network call. Dry runs stay usable without secrets because
every authenticated call is already gated on DRY_RUN. _maven.sh had this
check for the deploy path only, which is why prepare-rc's Nexus 401 was
equally opaque.

Also apply #3787's tag-push ordering to publish-release.sh. It pushed the
final tag in step 3 and released the staging repo in step 4, so a Nexus
failure left a published release tag and the "Final release tag already
exists" guard then blocked the retry -- the same trap #3787 removed from
prepare-rc, where eight orphaned 1.19.0 RC tags accumulated. Keep git tag
-a in step 3 for the local reads that follow and move only the push to
step 5, immediately before the GitHub release that needs it on the remote.

Generated-by: Claude Opus 5 (1M context)