feat: auto-track newest Godot and Blender in publish workflow

Replace the fixed 4.7.1 Dockerfile/workflow pin with:
- a nightly schedule that resolves the newest stable Godot (4.0+) and
  newest stable Blender, and builds+pushes <version> plus a floating
  latest tag only when the Godot version actually changed
- a workflow_dispatch free-text version input to (re)build any specific
  Godot version on demand, always with newest-at-build-time Blender,
  overwriting that tag without touching latest
- scripts/resolve-godot-version.sh and scripts/resolve-blender-url.sh,
  with shared parsing logic in scripts/lib.sh and an offline smoke test
  in scripts/test-lib.sh
- Blender is now fetched directly from download.blender.org instead of
  apt (Ubuntu noble's apt package is stuck on 4.0.2)
- drop the push-to-main trigger; schedule + workflow_dispatch only

Scope is Godot 4.0+ only — .blend import is a Godot 4 feature, so 3.x
builds have no use for the Blender toolchain this image adds.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/publish.yml

@@ -1,30 +1,92 @@
 name: Publish godot-ci image
 
 on:
-  push:
-    branches: [main]
-    paths: [Dockerfile]
+  schedule:
+    # Midnight daily. Picks up new Godot stable releases (and, incidentally, new
+    # Blender stables whenever it rebuilds — see resolve step below).
+    - cron: '0 0 * * *'
   workflow_dispatch:
+    inputs:
+      godot_version:
+        description: >-
+          Godot version to (re)build, e.g. 4.7.1 — must exist as a
+          barichello/godot-ci tag (https://hub.docker.com/r/barichello/godot-ci/tags).
+          Leave empty to build the newest stable, same as the nightly run.
+        required: false
+        type: string
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    env:
+      IMAGE: git.arthurerlich.de/haylan/godot-ci
+      DOCKER_CLI_EXPERIMENTAL: enabled
     steps:
       - uses: actions/checkout@v4
 
       - name: Log in to Gitea registry
         run: echo "${{ secrets.REGISTRY_PUSH_PAT }}" | docker login git.arthurerlich.de -u haylan --password-stdin
 
-      - name: Build and push
+      - name: Resolve target Godot version
+        id: resolve
         run: |
-          docker build -t git.arthurerlich.de/haylan/godot-ci:4.7.1 .
-          docker push git.arthurerlich.de/haylan/godot-ci:4.7.1
+          set -euo pipefail
+
+          if [ -n "${{ inputs.godot_version }}" ]; then
+            VERSION="${{ inputs.godot_version }}"
+            UPDATE_LATEST=false
+          else
+            VERSION="$(./scripts/resolve-godot-version.sh)"
+            UPDATE_LATEST=true
+          fi
+
+          if ! docker manifest inspect "barichello/godot-ci:${VERSION}" >/dev/null 2>&1; then
+            if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+              echo "::error::No barichello/godot-ci tag for '${VERSION}'. Check https://hub.docker.com/r/barichello/godot-ci/tags"
+              exit 1
+            fi
+            echo "::notice::Newest Godot stable is ${VERSION} but barichello/godot-ci has no matching tag yet — skipping, will retry tomorrow."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ "$UPDATE_LATEST" = true ] && docker manifest inspect "${IMAGE}:${VERSION}" >/dev/null 2>&1; then
+            echo "::notice::${VERSION} is already published and nothing changed — skipping."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "update_latest=${UPDATE_LATEST}" >> "$GITHUB_OUTPUT"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve newest Blender
+        if: steps.resolve.outputs.skip != 'true'
+        id: blender
+        run: echo "url=$(./scripts/resolve-blender-url.sh)" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push
+        if: steps.resolve.outputs.skip != 'true'
+        run: |
+          set -euo pipefail
+          VERSION="${{ steps.resolve.outputs.version }}"
+          docker build \
+            --build-arg GODOT_VERSION="$VERSION" \
+            --build-arg BLENDER_URL="${{ steps.blender.outputs.url }}" \
+            -t "${IMAGE}:${VERSION}" .
+          docker push "${IMAGE}:${VERSION}"
+
+          if [ "${{ steps.resolve.outputs.update_latest }}" = "true" ]; then
+            docker tag "${IMAGE}:${VERSION}" "${IMAGE}:latest"
+            docker push "${IMAGE}:latest"
+          fi
 
       # Gitea packages belong to the owner, not a repo, by default — pushing
       # the image alone does NOT make it show up under this repo's Packages
       # tab. Link it explicitly. Non-fatal: a failure here (e.g. already
       # linked) shouldn't fail a build whose push already succeeded.
       - name: Link package to this repository
+        if: steps.resolve.outputs.skip != 'true'
         run: |
           curl -sS -X POST \
             -H "Authorization: token ${{ secrets.REGISTRY_PUSH_PAT }}" \