feat(tooling): fetch-authlib.sh to download authlib-injector.jar

The server JVM agent (runtime/authlib-injector.jar, mounted at /extras) is
gitignored and was previously fetched by the deleted build-stack.sh prep. A
fresh checkout had no jar, so minecraft crashlooped with "Error opening zip
file or JAR manifest missing". Add a standalone fetch tool: resolves the latest
release asset, downloads, and verifies it's a real zip/jar (PK magic) before
trusting it. Idempotent (skips if valid, --force to re-download). Wire it into
the deploy skill and README launch steps.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

runtime/README.md

@@ -4,8 +4,9 @@ Runtime drop-ins mounted read-only into the Minecraft container at `/extras`.
 
 ## Required files
 
-- `authlib-injector.jar` — download latest from
-  https://github.com/yushijinhun/authlib-injector/releases
+- `authlib-injector.jar` — fetch with `tooling/fetch-authlib.sh` (downloads the
+  latest from https://github.com/yushijinhun/authlib-injector/releases and
+  verifies it's a valid jar). Gitignored.
 
 Mods are no longer listed here; the pack is served via packwiz
 (`PACKWIZ_URL`, see plan/04-packwiz.md).