Fix Maven scope and version selection in the POM dependency report

[alexander-yevsyukov]

What & why

The aggregated dependency report (docs/dependencies/pom.xml in consumer repos)
could mislabel a production dependency as <scope>test</scope> whenever a
test-only module happened to depend on the same artifact. Observed in
SpineEventEngine/core-jvm-compiler PR #94,
where io.spine:spine-base — an api dependency of production modules — flipped
to test scope.

Root cause: deduplicate() collapsed same-GAV entries with
distinctBy { it.gav }, keeping the first-encountered occurrence, whose
configuration then dictated the reported scope. Version selection was also a
plain lexicographic string compare, so 9.2.0 incorrectly outranked 10.0.0.

Changes

• Scope merge — deduplicate() now groups by group:name, retains the
  newest version, and among that version's usages reports the widest Maven
  scope. A dependency used via api in one module and testImplementation in
  another is reported as compile, not test.
• VersionComparator (new) — numeric-aware, SemVer-flavored version
  ordering: 10.0.0 > 9.2.0, 2.0.0-SNAPSHOT.100 > 2.0.0-SNAPSHOT.99,
  release > pre-release. Replaces the lexicographic compare. No new dependency.
• dependencyPriority() — re-ranked into the conventional Maven scope order
  (compile < provided < runtime < test < system < undefined) as an exhaustive
  when over the scope enum. The single ranking drives both scope selection and
  pom.xml layout, so compileOnly/annotationProcessor usages report as
  provided rather than test.

Tests

• VersionComparatorSpec — 7 tests (numeric ordering, release-vs-pre-release,
  segment edge cases).
• DependencyWriterSpec — 19 tests (ProjectBuilder-based): scope precedence,
  numeric version selection, and the end-to-end pom.xml regression.

./gradlew :buildSrc:test detekt green; spine-code-review, kotlin-engineer,
and review-docs all APPROVE.

Also on this branch

group-of-fixes bundles two small unrelated commits: an SSH log-message typo
fix (SshKey.kt) and agent-memory additions under .agents/memory/.

One-time downstream effect

On the next regeneration, consumer pom.xml reports list provided
dependencies above runtime — a one-time layout shift toward the Maven
convention.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes correctness issues in the Gradle-to-POM dependency report generator used across Spine SDK consumer repos, ensuring duplicated dependencies are reported with the newest semantic version and the widest (most production-relevant) Maven scope.

Changes:

• Reworked dependency de-duplication to (a) select the newest version via a numeric-aware comparator and (b) select the widest Maven scope among usages of that retained version.
• Introduced VersionComparator (SemVer-flavored ordering) and added end-to-end and unit tests covering scope precedence and version selection.
• Minor maintenance updates: scope-priority ordering aligned with Maven conventions; SSH log message typo fixed; added/updated agent task + memory docs.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
buildSrc/src/main/kotlin/io/spine/gradle/report/pom/DependencyWriter.kt	Fixes de-duplication to choose newest semantic version and widest scope for the retained version.
buildSrc/src/main/kotlin/io/spine/gradle/report/pom/ScopedDependency.kt	Updates scope priority to conventional Maven order (compile → provided → runtime → test → system → undefined).
buildSrc/src/main/kotlin/io/spine/gradle/report/pom/VersionComparator.kt	Adds a numeric-aware version comparator to avoid lexicographic mis-ordering (e.g., 10.x vs 9.x).
buildSrc/src/test/kotlin/io/spine/gradle/report/pom/DependencyWriterSpec.kt	Adds regression and precedence tests for scope merging, version selection, and XML layout ordering.
buildSrc/src/test/kotlin/io/spine/gradle/report/pom/VersionComparatorSpec.kt	Adds focused unit tests for semantic version comparison edge cases.
buildSrc/src/main/kotlin/io/spine/gradle/github/pages/SshKey.kt	Fixes an SSH config log message typo (“key file” → “config file”).
.agents/tasks/archive/pom-report-scope-merge.md	Archives the task plan/log for the dependency report scope/version fixes.
.agents/memory/project/porting-buildsrc-from-consumer-repos.md	Adds guidance for back-porting buildSrc improvements from consumer repos.
.agents/memory/project/config-build-verification.md	Documents the correct local verification command for buildSrc changes in config.
.agents/memory/MEMORY.md	Registers the newly added project memory entries in the index.