ci(workflow): drop hardcoded exec-maven-plugin:3.5.0 (PR-7.1)

[DemchaAV]

Summary

• Replace three hardcoded org.codehaus.mojo:exec-maven-plugin:3.5.0:java invocations in .github/workflows/ci.yml with exec:java, so the CI workflow resolves the plugin through benchmarks/pom.xml's build/plugins declaration (3.6.3).
• Add a Build entry to the in-progress v1.6.5 — Planned CHANGELOG section.

Why

benchmarks/pom.xml:134-138 already pins exec-maven-plugin:3.6.3 for
local benchmark runs, but CI bypassed that pin and invoked 3.5.0
directly — a silent version split between CI and local invocations
that grew the surface area to keep aligned. Using exec:java lets
Maven resolve the plugin through the module POM, so there is only one
version to bump going forward.

This is the third of three short branches unblocking the v1.6.5 cut
(alongside PR-7.2 #79 chore/byte-buddy-test-scope and PR-7.3
fix/pagebackgrounds-empty-and-row-weights). Tracked in the private
release-readiness taskboard.

Verification

The exact CI command was reproduced locally on JDK 17:

./mvnw -B -ntp -f benchmarks/pom.xml -DskipTests exec:java \
  -Dexec.mainClass=com.demcha.compose.CurrentSpeedBenchmark \
  -Dgraphcompose.benchmark.profile=smoke

→ Performance gate passed for profile smoke · BUILD SUCCESS · ~15 s.

The full and diff invocations follow the same pattern (only the
mainClass / profile / enforceGate flags differ), so plugin resolution
is identical.

Test plan

• Smoke benchmark reproduced locally with the new exec:java invocation
• CI perf-smoke green on PR
• Required CI checks (Guards / JDK 17/21/25 / Examples Smoke) green on PR
• Weekly benchmark-diff cron exercise — verified by maintainer post-merge (cron-only, not on PR)