buildMaskingUrls

Masking-loader urls: the Kotlin scripting stack (never on the module path) + the source of the repl.impl classes, so ReplHost resolves child-first.

Dev takes both from jvm args (mcp.kotlin.libs staging dir, mcp.repl.classes classes dir); production extracts mcp-kotlin/*.jar out of our own mod jar and adds that mod jar itself.