1) Eventually yes, but for now I think it's fine to tie this information to our releases. Don't worry about this for now. Businesses don't typically use the newest JARs in the legacy apps they are trying to migrate ;) We'd probably even be fine with data from 3 years ago.
2) Just put it in our main windup/windup repo for now, in the same module as the addon you're building.
3) Bundle it in the same addon that provides the functionality for now, it will be easier to include in our build. We can worry about externalizing it later. This will also allow us to create a separate distribution just in case people are worried about file size. (With Maven JAR identification / Without Maven JAR identification)
4) Better to access on the classpath because you know its location within the classloader. We can worry about externalizing it later.
45 MB is not terrible. Nice job.