I have included the generated sources for the SDK, but am guessing since in automations I don't have an actual Pulumi.yaml I need to also register the package / make it available, etc

Nope, just need the SDK. The stuff added to Pulumi.yaml normally is just for tracking so the SDKs can be re-generated again in the future if needed. Everything needed for runtime is inside the SDK itself.

So, say: my devops team defines several custom components for ecs (AWS) with things like cloudflare, albs, and security groups all bundled together... If they export the sdk for these components in Java format, I could just import it as a jar with the appropriate additional dependencies in my automation maven project?

yes assuming the component plugin itself is accessible, but if its working in a normal program it'll work with automation api as well

You mean the AWS and cloudflare plugins? , or also the custom one from my devops team?

well all, when they build the custom components if they're building that as a component plugin then they need to distribute that plugin. If they're just defining it as a java library, then it's just a java library. Some more details about component plugins at https://www.pulumi.com/blog/pulumi-components/

Ok, assuming it is component plugin, I guess we can't do that via an automation (or at least I couldn't find it in the Java api)

pulumi package gen-sdk --language java

to generate the SDK then just add that as a dependency to your automation project