Prevent OreSpawn verification from falling through to Maven Central

[SkyBlade1978]

Summary

• route the exact OreSpawn CurseMaven module through Gradle exclusiveContent
• use the checksum-pinned staging mirror as its only CI source
• retain CurseMaven as its only ordinary development source
• add a regression test for the repository-isolation contract

Why

Post-merge CI run 33015516287 staged and SHA-256 verified OreSpawn file 8739869, but Gradle could still probe Maven Central for the CurseMaven coordinate. Maven Central returned HTTP 429 and aborted configuration before compilation. Excluding CurseMaven when the mirror is supplied was not enough because other public repositories could still see the module.

Verification

• red-to-green workflow contract test
• refreshed resolution of the exact staged OreSpawn file and pinned SHA-256
• 36 tests passed across six suites
• complete clean build, Javadocs, dependency, artifact and checksum audits passed
• ForgeGradle Eclipse generation, isolation and production-classpath checks passed
• actionlint 1.7.12 passed
• two clean fixed-candidate assemblies produced identical hashes
• same-toolchain pre/post archive comparison found no production class, manifest, resource inventory or archive-structure change

This is a CI/dependency-routing repair only. It does not change Mineralogy gameplay, APIs, schemas, version, OreSpawn requirement, tags, or publication state.