transforming the POM coordinates from the get-go causes problems with the release plugin, since the .pom-transformed.xml file doesn't exist in the SCM, and the release plugin needs to rewrite AND THEN COMMIT the POM...if it only has access to the coordinate-transformed version of the POM, then it will commit overwriting the coordinate expressions.
At the same time, the GPG plugin uses project.getFile() as the source for signing the POM file, instead of using the ProjectArtifactMetadata from project.getArtifact().getMetadata()...so the release plugin and the GPG plugin are directly in conflict here.
Add to this the clean plugin, which deleted the target directory and won't allow the .pom-transformed.xml file to live there if it's created ahead of the clean plugin execution.
Finally, the shade plugin uses project.getOriginalModel() when generating the dependency-reduced POM, so any coordinate transformation has to manipulate this object as well.
The problem is that version-expression transformation happens during the install/deploy process, using the ArtifactTransformation interface. Since things like the GPG plugin produce metadata derived from the original file, this transformation renders those derivative files useless.