ci(contracts): provide scoped offline reproduction dependencies

Resolve baseline build and the proposed safe YAML parser for C03.
Export only public Maven artifacts and distribution, never credentials or settings.
Bundle runs only when its workflow changes or is explicitly dispatched.

Author: loong10k

.github/workflows/repro-bundle.yml

@@ -0,0 +1,42 @@
+name: Offline contract reproduction bundle
+on:
+  push:
+    branches: ['feature/2.0.x-contract-hardening']
+    paths: ['.github/workflows/repro-bundle.yml']
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  bundle:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+      - name: Verify baseline and resolve the proposed safe YAML parser
+        run: |
+          bash ./mvnw -B --no-transfer-progress clean verify
+          bash ./mvnw -B --no-transfer-progress org.apache.maven.plugins:maven-dependency-plugin:3.8.1:get -Dartifact=org.yaml:snakeyaml:2.6
+      - name: Package only public Maven artifacts and distribution
+        shell: bash
+        run: |
+          mkdir -p repro-bundle
+          git rev-parse HEAD > repro-bundle/source-head.txt
+          java -version > repro-bundle/java.txt 2>&1
+          bash ./mvnw -version > repro-bundle/maven.txt 2>&1
+          # Never include settings.xml, toolchains.xml, Git credentials or environment dumps.
+          tar -czf repro-bundle/maven-repository.tar.gz -C "$HOME/.m2" repository
+          distribution="$(find "$HOME/.m2/wrapper/dists" -type d -name apache-maven-3.9.16 -print -quit)"
+          test -n "$distribution"
+          tar -czf repro-bundle/maven-distribution.tar.gz -C "$(dirname "$distribution")" apache-maven-3.9.16
+          (cd repro-bundle && sha256sum *.tar.gz > SHA256SUMS)
+      - uses: actions/upload-artifact@v7
+        with:
+          name: opencli-offline-repro-${{ github.sha }}
+          path: repro-bundle
+          retention-days: 3
+          if-no-files-found: error