fix(bundle): package graph-compose-bundle as a jar, not pom

[DemchaAV]

Why

A Phase-8 consumer-dependency check (five minimal projects built against local 2.0.0-SNAPSHOT)
found that graph-compose-bundle was <packaging>pom</packaging>, so a plain
<dependency>graph-compose-bundle</dependency> — the exact form the README's "batteries-included"
row shows — fails to resolve a jar and breaks the consumer's build. It works only if the consumer
adds <type>pom</type>, which the README doesn't mention. The graph-compose wrapper already made
the opposite choice for exactly this reason (its pom comment: "Packaging is jar … NOT pom: a
pom would force every consumer to add <type>pom</type> and break their build") — the bundle was
simply left inconsistent.

What

Package graph-compose-bundle as an empty jar carrying only <dependencies>, mirroring the
graph-compose wrapper:

• <packaging>pom</packaging> → jar; added the maven-compiler + maven-jar plugins and the
  version properties they need.
• Added the empty maven-source (jar-no-fork) + maven-javadoc (failOnError=false) jars to the
  release profile — the same Maven Central setup the wrapper uses (both modules carry no sources,
  so the wrapper and the bundle produce the same artifact set, and the wrapper publishes to Central
  today).

No README change needed: the existing plain-dependency snippet is now correct.

Tests

• Consumer d (graph-compose-bundle) re-run with a plain <dependency> (no <type>pom>):
  compiles + renders a PDF (853 bytes). Before: fails to resolve.
• The other four consumer scenarios are unaffected (core-only → correct MissingBackendException;
  wrapper → PDF; core+templates+render-pdf → PDF; wrapper+render-docx → PDF + DOCX).
• -P release -pl :graph-compose-bundle package exits 0 and produces the bundle jar (same output as
  the wrapper's release package).
• VersionConsistencyGuardTest green (bundle version still tracks the engine).
• Full reactor gate (CI module set + bundle) green.

Build/packaging only; no runtime or API change.