feat: auto-track newest Godot and Blender in publish workflow

Replace the fixed 4.7.1 Dockerfile/workflow pin with:
- a nightly schedule that resolves the newest stable Godot (4.0+) and
  newest stable Blender, and builds+pushes <version> plus a floating
  latest tag only when the Godot version actually changed
- a workflow_dispatch free-text version input to (re)build any specific
  Godot version on demand, always with newest-at-build-time Blender,
  overwriting that tag without touching latest
- scripts/resolve-godot-version.sh and scripts/resolve-blender-url.sh,
  with shared parsing logic in scripts/lib.sh and an offline smoke test
  in scripts/test-lib.sh
- Blender is now fetched directly from download.blender.org instead of
  apt (Ubuntu noble's apt package is stuck on 4.0.2)
- drop the push-to-main trigger; schedule + workflow_dispatch only

Scope is Godot 4.0+ only — .blend import is a Godot 4 feature, so 3.x
builds have no use for the Blender toolchain this image adds.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/lib.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Shared parsing helpers for resolve-godot-version.sh and resolve-blender-url.sh.
+# Kept separate from the network calls so the parsing logic can be unit-tested
+# offline — see test-lib.sh.
+
+# Reads a GitHub releases API response (JSON array) on stdin, prints the newest
+# non-prerelease, non-draft tag with its "-stable" suffix stripped (e.g. "4.7.1").
+parse_latest_godot_tag() {
+  jq -r '[.[] | select(.prerelease == false and .draft == false)][0].tag_name' | sed 's/-stable$//'
+}
+
+# Reads the download.blender.org/release/ index HTML on stdin, prints the newest
+# "X.Y" minor-version directory name (no trailing slash), numerically not
+# lexicographically (so "4.10" correctly beats "4.2").
+parse_latest_blender_minor() {
+  grep -oE 'Blender[0-9]+\.[0-9]+/' | grep -oE '[0-9]+\.[0-9]+' | sort -t. -k1,1n -k2,2n -u | tail -1
+}
+
+# Reads a Blender minor-version release index HTML on stdin, prints the newest
+# linux-x64 tarball filename (ignores windows/mac assets and .sha256 sidecars).
+parse_latest_blender_tarball() {
+  grep -oE 'blender-[0-9.]+-linux-x64\.tar\.xz' | sort -V -u | tail -1
+}

scripts/resolve-blender-url.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Prints the download URL of the newest stable Blender linux-x64 release tarball.
+# No official "latest stable" API exists for Blender (only the experimental-builds
+# API does) so this scrapes the release index — see docs/handoff for background.
+# Requires: curl.
+set -euo pipefail
+cd "$(dirname "$0")"
+. ./lib.sh
+
+base="https://download.blender.org/release/"
+minor=$(curl -fsSL "$base" | parse_latest_blender_minor)
+minor_url="${base}Blender${minor}/"
+file=$(curl -fsSL "$minor_url" | parse_latest_blender_tarball)
+
+echo "${minor_url}${file}"

scripts/resolve-godot-version.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Prints the newest stable Godot Engine version (e.g. "4.7.1"), no "-stable" suffix.
+# Requires: curl, jq.
+set -euo pipefail
+cd "$(dirname "$0")"
+. ./lib.sh
+
+curl -fsSL https://api.github.com/repos/godotengine/godot/releases | parse_latest_godot_tag

scripts/test-lib.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Offline smoke test for lib.sh's parsing logic (no network). Run: ./scripts/test-lib.sh
+set -euo pipefail
+cd "$(dirname "$0")"
+. ./lib.sh
+
+fail() { echo "FAIL: $1" >&2; exit 1; }
+
+# parse_latest_godot_tag: skips prereleases and drafts, strips "-stable"
+# (needs jq — present on the CI runner; skipped here if this machine lacks it)
+if command -v jq >/dev/null 2>&1; then
+  got=$(printf '%s' '[
+    {"tag_name":"4.8-rc1","prerelease":true,"draft":false},
+    {"tag_name":"4.7.1-stable","prerelease":false,"draft":false},
+    {"tag_name":"4.7-stable","prerelease":false,"draft":false},
+    {"tag_name":"4.8-dev-draft","prerelease":false,"draft":true}
+  ]' | parse_latest_godot_tag)
+  [ "$got" = "4.7.1" ] || fail "parse_latest_godot_tag: got '$got', want 4.7.1"
+else
+  echo "skip: parse_latest_godot_tag (jq not installed on this machine)" >&2
+fi
+
+# parse_latest_blender_minor: numeric sort, not lexicographic ("4.10" > "4.2")
+got=$(printf '%s' '<a href="Blender3.6/">Blender3.6/</a> <a href="Blender4.2/">Blender4.2/</a> <a href="Blender4.10/">Blender4.10/</a>' \
+  | parse_latest_blender_minor)
+[ "$got" = "4.10" ] || fail "parse_latest_blender_minor: got '$got', want 4.10"
+
+# parse_latest_blender_tarball: newest patch, ignores sha256 sidecars and other OSes
+got=$(printf '%s' '<a href="blender-4.2.1-linux-x64.tar.xz">x</a>
+<a href="blender-4.2.10-linux-x64.tar.xz">x</a>
+<a href="blender-4.2.10-linux-x64.tar.xz.sha256">x</a>
+<a href="blender-4.2.10-windows-x64.zip">x</a>' | parse_latest_blender_tarball)
+[ "$got" = "blender-4.2.10-linux-x64.tar.xz" ] || fail "parse_latest_blender_tarball: got '$got', want blender-4.2.10-linux-x64.tar.xz"
+
+echo "ok: scripts/lib.sh"