Switch from fat-jar to thin-jar packaging for library consumers

[khatchad]

Problem

Ariadne (`com.ibm.wala.cast.python.ml`) currently ships as a single shaded fat-jar via `maven-shade-plugin`. This made sense for the original standalone LSP web server use case (single executable JAR with everything embedded) but is a poor fit for library consumers (e.g., ponder-lab/Hybridize-Functions-Refactoring), which inherited the fat-jar shape accidentally when library usage was added — at the time, the fat-jar was the only thing that worked.

Concrete Costs To Library Consumers

• Shaded copies of common libraries (Guava, gson, lsp4j, jython3, WALA modules, etc.) can conflict with versions the consumer pulls through its own dependency tree.
• Inherits packaging warts from shaded dependencies. Concrete example: `ProxyDeserialization.class` at the default (unnamed) package level (originating from jython3) breaks Tycho 5+ bnd auto-wrap with `The default package '.' is not permitted by the Import-Package syntax`. Tycho 2.7.5's looser bnd accepted this silently; Tycho 5's stricter bnd rejects it.
• Workarounds discovered in Hybridize-Functions-Refactoring (`` overrides, `` filtering, `_fixupmessages` directives) all proved fragile or incomplete; the `` element in particular silently breaks Tycho's `Bundle-SymbolicName` derivation.
• ~12 MB payload for consumers that only need the analysis API.
• Frozen transitive dependency versions; consumers cannot independently upgrade Guava, gson, etc.
• Tycho's auto-wrap of the fat-jar produces an OSGi bundle, but every change to wrap configuration is brittle.

Proposed Architecture

• Default artifact: thin jar containing only Ariadne's own classes.
• `pom.xml` declares `` on jython3, gson, lsp4j, WALA modules, etc., explicitly.
• Library consumers (Hybridize) declare a `` on the thin jar; Maven/Tycho resolves transitives via the normal dependency tree.
• The standalone LSP server use case keeps a fat-jar via a `-fat` (or `-uber`) classifier, leaving the default artifact thin.

Out Of Scope For This Issue

• The immediate `ProxyDeserialization.class` blocker is being patched separately by excluding that single file from the shade output, since the strategic fix needs more design and a release cycle.
• Whether to keep `maven-shade-plugin` for the classified fat-jar or move to `maven-assembly-plugin`.

Why Now

Hybridize's Tycho 5 / Java 25 upgrade work surfaced multiple wrapping issues that would not exist with thin-jar packaging. The shade-exclude patch unblocks the immediate work, but each future upgrade is likely to surface a new variant of the same root cause until the architecture changes.

[khatchad]

Adding another symptom to the fat-jar list: Jython's bootstrap (org.python.util.PythonInterpreter.<init>) NPEs under Tycho-OSGi consumers because _frozen_importlib.class isn't reachable from the OSGi bundle classloader (the fat-jar contains org/python/* Jython classes but no src/resources/frozen_importlib/ entries; Jython has a fallback that succeeds in plain Maven-surefire but not in OSGi). Defensive catch landed in ponder-lab/ML#191 / wala/ML#439 so the analysis stays alive, but the underlying packaging gap is filed as ponder-lab/Hybridize-Functions-Refactoring#429. Worth mentioning here as another data point that the fat-jar shape is awkward for downstream OSGi/Tycho consumers.