Make release archives reproducible

[GerwinVerkerk]

Problem

The generated archives depend on filesystem directory order and preserve file timestamps. clean also leaves the custom target/ and target-api/ output directories behind. Identical source can therefore produce different checksums or retain stale artifacts.

Solution

• sort hook discovery in both settings and runtime dependency inclusion;
• disable archive timestamps and enable reproducible file ordering for every JAR task;
• make clean remove both custom output directories.

Keeping the current archives and comparing extracted contents was considered, but rejected because release integrity checks need a stable artifact checksum, not only equivalent unpacked files.

Verification

• ./gradlew --no-daemon clean build — passed on Java 25
• two consecutive clean shadowJar builds produced identical hashes:
  • plugin: 709ca0263fb01beca356b87482e804e3c05bd1dd0caad1d990c8132beb06effa
  • API: c0fd6aad83cdcfaf183132b4e66bfb3b10bfacc3775f38e77424a0bc338a16a9
• git diff --check — passed

Impact and risk

• No runtime, gameplay, command, permission, configuration, schema, data, or dependency changes.
• Hook inclusion remains the same; only its ordering becomes deterministic.
• Build outputs are deleted and rebuilt by clean, as expected.

Rollback

Revert the commit. Existing release artifacts are not modified.