feat(build-stack): fetch authlib-injector.jar during prep

Server JVM agent needs runtime/authlib-injector.jar (gitignored); pull the
latest yushijinhun release if absent so pre-bake doesn't crash-loop on a
missing agent jar.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tooling/build-stack.sh

@@ -72,6 +72,17 @@ prep() {
   have_script fetch-launcher.sh
   tooling/fetch-launcher.sh
 
+  log "fetch authlib-injector.jar (server JVM agent → drasl)"
+  if [ -f runtime/authlib-injector.jar ]; then
+    echo "  runtime/authlib-injector.jar present — skipping"
+  else
+    ai_url="$(curl -fsSL https://api.github.com/repos/yushijinhun/authlib-injector/releases/latest \
+      | jq -r '.assets[] | select(.name|test("authlib-injector-[0-9].*\\.jar$")) | .browser_download_url' | head -1)"
+    [ -n "$ai_url" ] && [ "$ai_url" != "null" ] || die "could not resolve authlib-injector release asset"
+    curl -fSL --retry 3 -o runtime/authlib-injector.jar "$ai_url"
+    echo "  downloaded $(basename "$ai_url")"
+  fi
+
   log "pre-bake server volume (TYPE=NEOFORGE install, one-shot, online)"
   # Bring minecraft up once so itzg installs NeoForge + mods into the volume,
   # then stop it. The party then runs offline against the baked volume.