Make reproducible builds the default for all projects inheriting java-parent #3

Artifacts built from java-parent embed the wall-clock build time, so two builds of
the same source differ. Measured on a probe child project: jar, sources jar, javadoc
jar, bom.json and bom.xml all differ between two consecutive builds.

Reproducibility currently exists only inside Open Elements CI, which passes
-Dproject.build.outputTimestamp on the command line. That flag is invisible to
outsiders, so a third party checking out a release tag cannot reproduce the
published bytes.

Move the timestamp into a fixed literal in the parent POM, inherited by all child
projects, and maintain it from release.sh.

Full technical design and behavioral scenarios:
docs/specs/001-reproducible-build-timestamp/

Acceptance criteria

• project.build.outputTimestamp is a fixed literal in pom.xml <properties>
• Both workflows build without any -Dproject.build.outputTimestamp argument
• release.sh rewrites the property to the release date when bumping the version
• A child project builds byte-identically twice with no extra flags
• README documents the narrow claim (same source + same toolchain) and
  Git-Commit-Time as the build-time replacement

Out of scope

Cross-toolchain reproducibility, automated verification, and changes to consumer
projects are deliberately deferred. All deferred items are tracked in docs/TODO.md.