SK-3037 stop publishing the contract-testing comparison jar - #403

The problem

The comparison jar the contract gate builds was being published.

shadedArtifactAttached makes it a real project artifact, and Maven installs and
deploys attached artifacts. A deploy to a throwaway local repo shows exactly what
would have reached jfrog and Maven Central:

skyflow-flowvault-java-<v>.jar
skyflow-flowvault-java-<v>.pom
skyflow-flowvault-java-<v>-sources.jar
skyflow-flowvault-java-<v>-tests.jar
skyflow-flowvault-java-<v>-with-common.jar   ← should never have shipped

Same for skyvault. It is a build input for japicmp, not something a consumer
should be able to resolve — and it contains the whole SDK plus common under a
classifier, so anyone who found it would get a second, silently divergent copy of
the library.

This came in with #397, so it is live on the next release. Nothing has shipped with
it yet.

The fix

Two changes, so this cannot recur by accident:

1. Never attach it. Switched to shade's outputFile, which writes the jar to
disk and attaches nothing. No artifact, so nothing to install or deploy.

2. Move it out of the modules. It now lands in the repo-root api-report/build/
(gitignored). Nothing under a module directory can package or publish what it cannot
see — the guarantee is structural, not a setting someone has to remember.

The committed baselines move the same way, <module>/api-report/ → repo-root
api-report/. They were never packaged — api-report/ is not a resource directory,
and they appear zero times inside every built jar — but keeping the contract
fixtures out of the source trees makes that structural too.

api-report/
  skyflow-java.baseline.jar                    committed — the approved contract
  skyflow-flowvault-java.baseline.jar          committed
  build/                                       gitignored — comparison jars

Also set createDependencyReducedPom=false on this execution. It is a second shade
run whose only job is to produce a comparison file; it has no business rewriting the
pom the module publishes.

Verification

A real mvn deploy to a throwaway repo now publishes exactly this, per module:

No with-common, and find skyvault flowvault common -name "*with-common*" returns
nothing.

Also: both contract gates pass reading the new paths; contract-snapshot-update.sh
regenerates from api-report/build/; common 158 and flowvault 674 tests pass;
YAML parses; cspell clean across 305 files.

skyvault's 3 ConnectionClientTests failures are pre-existing and unrelated — they
need the real SKYFLOW_CREDENTIALS secret, which CI supplies.

No source, README or release-workflow changes.