Phase 9: reproducible builds, balance from the server, spark check, play feedback

Build: every tool pinned (JDK, packwiz, Gradle plugins, Python packages), exports
normalised, tools/check_reproducible.py proves two clean builds are byte-identical.

Server-side balance: a server can load config/cobblesurvival/datapack.zip in place of
the jar's data, /reload applies it, tools/server_update.py packages it and refuses
when a client change is needed. JEI drop pages are sent by the server. Code-held
balance numbers moved to tuning/server.json.

Performance: spark in the pack (server only), tools/perf_test.py with fake players
whose chunks really are active, docs/performance.md.

Adrian's feedback: default keys R, U, J, §; drop pages link to Cobblemon Info and show
real chances; bosses only hurt in battles; battle XP halved; channels between the
islands low level; temperature ×3 with insulation doubled; hazards start at once; no
item dots on the map; a wild attack starts a battle; the starter only faints; quest
book on join with a basics page and an HMs page; regional forms obtainable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/packwiz_sync.py

@@ -14,27 +14,11 @@ import shutil
 import subprocess
 import sys
 import threading
-import urllib.request
 from pathlib import Path
 
+import lock
+
 ROOT = Path(__file__).resolve().parent.parent
-CACHE = ROOT / "build" / ".cache"
-# Pinned; the bootstrap runs with --bootstrap-no-update so neither self-updates.
-TOOLS = {
-    "packwiz-installer-0.5.14.jar":
-        "https://github.com/packwiz/packwiz-installer/releases/download/v0.5.14/packwiz-installer.jar",
-    "packwiz-installer-bootstrap-0.0.3.jar":
-        "https://github.com/packwiz/packwiz-installer-bootstrap/releases/download/v0.0.3/packwiz-installer-bootstrap.jar",
-}
-
-
-def cached(name):
-    jar = CACHE / name
-    if not jar.exists():
-        CACHE.mkdir(parents=True, exist_ok=True)
-        with urllib.request.urlopen(TOOLS[name], timeout=120) as r, open(jar, "wb") as f:
-            shutil.copyfileobj(r, f)
-    return jar
 
 
 def java():
@@ -56,9 +40,9 @@ def sync(side, target, pack_dir):
     threading.Thread(target=server.serve_forever, daemon=True).start()
     try:
         url = f"http://127.0.0.1:{server.server_port}/pack.toml"
-        subprocess.run([java(), "-jar", str(cached("packwiz-installer-bootstrap-0.0.3.jar")),
+        subprocess.run([java(), "-jar", str(lock.download("packwiz-installer-bootstrap-0.0.3.jar")),
                         "--bootstrap-no-update",
-                        "--bootstrap-main-jar", str(cached("packwiz-installer-0.5.14.jar")),
+                        "--bootstrap-main-jar", str(lock.download("packwiz-installer-0.5.14.jar")),
                         "-g", "-s", side, url],
                        cwd=target, check=True)
     finally: