build: extract graph-compose-testing into its own module

[DemchaAV]

Why

The consumer testing helpers — LayoutSnapshotAssertions (deterministic layout
snapshots) and PdfVisualRegression (page pixel-diff) — shipped inside the
graph-compose jar, pulling Jackson and PDFBox onto every consumer. 2.0 splits
them into their own module so the core stays lean and consumers add the testing
support at test scope only when they want it. The packages are unchanged, so
imports stay the same; only the artifact that carries them moves.

What

• graph-compose-testing — new published module (standalone + lockstep with
  the engine, like render-docx), carrying com.demcha.compose.testing.{layout,visual}
  plus its Jackson + PDFBox dependencies. The engine pom drops Jackson.
• graph-compose-qa — new non-published module (aggregator child at the
  reactor tail) holding the cross-module suites that import the testing module.
  They can't stay in the engine's test scope: the engine can't test-depend on a
  module that compile-depends on it (a reactor cycle). They reuse the engine's
  shared test scaffolding through its existing tests-classifier jar, and their
  snapshot/visual baselines move with them.
• Build / CI / release wiring — both modules added to aggregator/pom.xml;
  the CI build gate now runs the engine + testing + qa reactor slice on every
  matrix JDK; publish.yml deploys graph-compose-testing after the engine;
  cut-release.ps1 bumps and commits testing/pom.xml in lockstep (qa inherits
  its version from the aggregator, so it needs none).
• VersionConsistencyGuardTest extended to hold graph-compose-testing and
  graph-compose-render-docx at the engine version and to require qa to inherit
  its version.
• Consumer docs + CHANGELOG note the new test-scope dependency; imports are
  unchanged.

Tests

• Standalone engine: ./mvnw clean verify -pl . → BUILD SUCCESS, 1229 tests.
• Reactor slice: ./mvnw -f aggregator/pom.xml clean verify -pl :graph-compose,:graph-compose-testing,:graph-compose-qa -am
  → BUILD SUCCESS — engine + graph-compose-testing (7) + graph-compose-qa (134).
  The moved snapshot/visual suites pass against their relocated baselines, so
  renders stay byte-identical.