feat: auto-track newest Godot and Blender in publish workflow

Replace the fixed 4.7.1 Dockerfile/workflow pin with:
- a nightly schedule that resolves the newest stable Godot (4.0+) and
  newest stable Blender, and builds+pushes <version> plus a floating
  latest tag only when the Godot version actually changed
- a workflow_dispatch free-text version input to (re)build any specific
  Godot version on demand, always with newest-at-build-time Blender,
  overwriting that tag without touching latest
- scripts/resolve-godot-version.sh and scripts/resolve-blender-url.sh,
  with shared parsing logic in scripts/lib.sh and an offline smoke test
  in scripts/test-lib.sh
- Blender is now fetched directly from download.blender.org instead of
  apt (Ubuntu noble's apt package is stuck on 4.0.2)
- drop the push-to-main trigger; schedule + workflow_dispatch only

Scope is Godot 4.0+ only — .blend import is a Godot 4 feature, so 3.x
builds have no use for the Blender toolchain this image adds.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -1,20 +1,38 @@
 # godot-ci
 
-Custom image extending `barichello/godot-ci:4.7.1` with the Godot 4.7.1 export-template toolchain
-pre-installed, so `Project4x`'s `export-template.yml` doesn't `apt-get install` it on every release
-run.
+Custom image extending `barichello/godot-ci` with the Godot export-template toolchain and Blender
+pre-installed, so `Project4x`'s `export-template.yml` doesn't `apt-get install` them on every
+release run.
 
-Built from the handoff spec at `Project4x`'s `docs/handoff/godot-ci-custom-image.md`.
+Built from the handoff spec at `Project4x`'s `docs/handoff/godot-ci-custom-image.md`; scope and
+versioning have since moved on from that spec — see below.
 
 ## Image
 
-`git.arthurerlich.de/haylan/godot-ci:4.7.1`
+`git.arthurerlich.de/haylan/godot-ci:<godot-version>`, e.g. `git.arthurerlich.de/haylan/godot-ci:4.7.1`,
+plus a floating `git.arthurerlich.de/haylan/godot-ci:latest` that always points at the newest.
 
-Published automatically by `.gitea/workflows/publish.yml` on every push to `main` that touches
-`Dockerfile`, or manually via workflow dispatch.
+Godot **4.0+** only (Blender's `.blend` import is a Godot 4 feature — 3.x builds have no use for
+this image's Blender toolchain).
 
-A Godot version bump means updating `Dockerfile`'s `FROM` line and the tag in both the workflow
-and this README together.
+### How versions get built
+
+`.gitea/workflows/publish.yml`:
+
+- **Nightly (midnight, `schedule:`)**: resolves the newest *stable* Godot release
+  (`scripts/resolve-godot-version.sh`) and the newest stable Blender
+  (`scripts/resolve-blender-url.sh`), and rebuilds+pushes `<version>` + `latest` only if that
+  Godot version isn't already published. If `barichello/godot-ci` hasn't tagged the new Godot
+  version yet, the run skips (with a notice, not a failure) and retries the next night.
+- **Manual (`workflow_dispatch`)**: type a Godot version (e.g. `4.6.3`) to (re)build and push that
+  exact tag, always with whatever Blender is newest at build time. Overwrites the tag if it
+  already exists. Does **not** touch `latest`. Fails clearly if `barichello/godot-ci` has no
+  matching tag — check
+  [its tag list](https://hub.docker.com/r/barichello/godot-ci/tags) first.
+
+Blender has no official "latest stable" API — `resolve-blender-url.sh` scrapes
+`download.blender.org/release/`. `scripts/test-lib.sh` is an offline smoke test for the parsing
+logic both resolve scripts share (`scripts/lib.sh`).
 
 ## Auth
 
@@ -29,7 +47,8 @@ cannot push to the package registry on this instance.
 
 ## Consuming this image
 
-In `Project4x`'s `.gitea/workflows/export-template.yml`:
+In `Project4x`'s `.gitea/workflows/export-template.yml`, pin to a specific version (recommended,
+matches whatever `GODOT_VERSION` the project itself targets) or float on `latest`:
 
 ```diff
 - container: barichello/godot-ci:4.7.1