Phase 9: reproducible builds, balance from the server, spark check, play feedback

Build: every tool pinned (JDK, packwiz, Gradle plugins, Python packages), exports
normalised, tools/check_reproducible.py proves two clean builds are byte-identical.

Server-side balance: a server can load config/cobblesurvival/datapack.zip in place of
the jar's data, /reload applies it, tools/server_update.py packages it and refuses
when a client change is needed. JEI drop pages are sent by the server. Code-held
balance numbers moved to tuning/server.json.

Performance: spark in the pack (server only), tools/perf_test.py with fake players
whose chunks really are active, docs/performance.md.

Adrian's feedback: default keys R, U, J, §; drop pages link to Cobblemon Info and show
real chances; bosses only hurt in battles; battle XP halved; channels between the
islands low level; temperature ×3 with insulation doubled; hazards start at once; no
item dots on the map; a wild attack starts a battle; the starter only faints; quest
book on join with a basics page and an HMs page; regional forms obtainable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mod/build.gradle.kts

@@ -1,7 +1,7 @@
 plugins {
     id("java")
-    id("dev.architectury.loom") version ("1.11-SNAPSHOT")
-    id("architectury-plugin") version ("3.4-SNAPSHOT")
+    id("dev.architectury.loom") version ("1.11.458")
+    id("architectury-plugin") version ("3.4.164")
     // Must read the stdlib that Kotlin for Forge ships (5.12.0 -> Kotlin 2.4.0).
     kotlin("jvm") version ("2.4.0")
 }
@@ -62,6 +62,12 @@ kotlin {
 }
 
 tasks {
+    // Same sources, same bytes (tools/check_reproducible.py).
+    withType<AbstractArchiveTask>().configureEach {
+        isPreserveFileTimestamps = false
+        isReproducibleFileOrder = true
+    }
+
     test {
         useJUnitPlatform()
     }