Closing this question with an easily discovered answer (not my own). See comment by @Gaël J:

Sonatype changed the way to authenticate a few months ago. You need to use a toke now. See central.sonatype.org/news/20240617_migration_of_accounts and central.sonatype.org/publish/generate-token