Phase 9: the private pack to hand out

build/...-private.mrpack lists every mod by download link, CurseForge-only ones
included, with the credits and non-affiliation notice inside and no third-party jar.
tools/check_private_pack.py downloads all of it and checks the hashes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap.md

@@ -196,7 +196,7 @@ Goal: a quest book that points players onward, laid out like a research tree who
 - **Reproducible builds** (Adrian, 2026-11-09). The same commit gives the same bytes: pinned JDK, packwiz, Gradle plugins and Python packages; `tools/check_reproducible.py` proves it.
 - **Balancing on the server** (Adrian, 2026-11-09). Balance changes reach playtesters without a client update: `tools/server_update.py`, a server-held data pack, JEI pages sent by the server.
 - **Multiplayer test** with Adrian's group.
-- **Release.** Final `docs/licenses.md`, credits and non-affiliation disclaimer; publish client and server packs on Modrinth and CurseForge as dependency-based packs.
+- **Release.** No public release (Adrian, 2026-11-09): `build/…-private.mrpack`, every mod by download link, credits and non-affiliation notice inside; Adrian hands it out himself.
 
 **Done when:** a full playthrough from spawn to the last zone is possible without commands, every implemented Pokémon can be obtained without commands, and a server runs a multi-hour session without tick-time spikes from Pokémon entities.