build(amd-h): vendor GlobalPlatform exports for j3r452 builds

Drops gpapi-globalplatform 1.7 and gpapi-upgrade 1.1 (AMD-H Amendment H
v1.1) under applet/build-tools/gp-amdh/, sourced from
OpenJavaCard/globalplatform-exports (master snapshot 2020-09-30).

- dt-mvn.sh mounts exports/org/ into the converter's api_export_files/.
- pom.xml adds the .jar files as system-scope deps under the j3r452
  profile so javac on j3r452 builds resolves org.globalplatform.upgrade
  symbols (j3r180 builds don't see them on classpath).
- .gitignore: narrow build-tools/ exclusion to top-level only so the new
  applet/build-tools/gp-amdh/ tree is trackable while the top-level
  build-tools/jcardsim/ vendor fork stays out of the repo.

This commit alone produces zero CAP bytecode change because no current
source imports org.globalplatform.*. The infra is provably inert until
the Task 3.1+ source on feat/amd-h-epic-3-wip is merged. Verified by
diffing CAP zip components for both profiles: only the embedded
Java-Card-CAP-Creation-Time timestamp in META-INF/MANIFEST.MF differs.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

applet/scripts/dt-mvn.sh

@@ -21,8 +21,16 @@ if ! docker volume inspect "$VOLUME" >/dev/null 2>&1; then
         -c 'cp -a /root/.m2/. /dst/ && chmod -R a+rwX /dst'
 fi
 
+# GlobalPlatform Amendment H export files (vendored under build-tools/gp-amdh/).
+# Mounted into the SDK's api_export_files tree so the JC 3.0.5 converter can
+# resolve org.globalplatform.* imports during CAP conversion. The mount is
+# unconditional: when the j3r180 profile builds, no source imports those
+# packages, so the converter never opens these exports.
+GP_AMDH_EXPORTS="$project_root/build-tools/gp-amdh/exports/org"
+
 exec docker run --rm -t \
     -v "$project_root:/work" -w /work \
     -v "$VOLUME:/root/.m2" \
+    -v "$GP_AMDH_EXPORTS:/app/sdks/jc305u3_kit/api_export_files/org:ro" \
     -e JC_CLASSIC_HOME=/app/sdks/jc305u3_kit \
     "$IMAGE" "mvn $*"