Replace vendored jars with verified Maven Central dependencies

374 of 419 vendored jars are replaced by version-catalog coordinates
(gradle/libs.versions.toml). Every adopted coordinate was SHA-1-matched
byte-identical to the vendored jar it replaces; resolution is
non-transitive so the runtime artifact set stays exactly the audited
set, and gradle/verification-metadata.xml enforces sha256 on every
resolution. gradle/vendored-layout.json maps each artifact to its
historical place in the distribution; per-project placement checks
(aggregated by verifyVendoredParity, required by every build and by
setup assembly) fail if a resolved artifact lacks a placement. The 45
jars without a byte-identical published artifact stay vendored, each
with an evidence-based reason in
tools/build-parity/jar-provenance.json.

Distribution output is verified entry-content identical to an Ant
build of this branch's parent commit: 490 of 490 archives, zero
differences beyond tool metadata. Tooling and methodology in
tools/build-parity/.

Refs #52, #146

Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>

Author: pacmano1

BUILD-MIGRATION.md

@@ -363,6 +363,40 @@ tasks.register('clean') {
     dependsOn ':donkey:clean', ':server:clean', ':client:clean', ':command:clean', ':generator:clean'
 }
 
+// Writes one SHA line per file of the staged distribution to
+// build/distribution-snapshot.txt. The protocol for changing build
+// logic: snapshot, make the change, build, snapshot again, diff. Only
+// the changes you intended should appear (see CONTRIBUTING.md).
+tasks.register('snapshotDistribution') {
+    group = 'verification'
+    description = 'Writes a SHA-256 line per file of server/setup for before/after comparison of build changes.'
+    outputs.upToDateWhen { false }
+    doLast {
+        def setupDir = file('server/setup')
+        if (!setupDir.directory) {
+            throw new GradleException('server/setup does not exist; run ./gradlew build first')
+        }
+        def out = new StringBuilder()
+        def md = java.security.MessageDigest.getInstance('SHA-256')
+        setupDir.eachFileRecurse(groovy.io.FileType.FILES) { f ->
+            md.reset()
+            f.withInputStream { ins ->
+                byte[] buf = new byte[1 << 20]
+                int n
+                while ((n = ins.read(buf)) > 0) {
+                    md.update(buf, 0, n)
+                }
+            }
+            def rel = setupDir.toPath().relativize(f.toPath())
+            out.append(md.digest().encodeHex()).append('  ').append(rel).append('\n')
+        }
+        def target = file('build/distribution-snapshot.txt')
+        target.parentFile.mkdirs()
+        target.text = out.readLines().sort().join('\n') + '\n'
+        logger.lifecycle "snapshot written: ${target} (${target.readLines().size()} files)"
+    }
+}
+
 // Aggregate: the per-project checks resolve each configuration in its
 // OWNING project's context (Gradle-9-safe; no cross-project resolution).
 tasks.register('verifyVendoredParity') {