feat: auto-track newest Godot and Blender in publish workflow

Replace the fixed 4.7.1 Dockerfile/workflow pin with:
- a nightly schedule that resolves the newest stable Godot (4.0+) and
  newest stable Blender, and builds+pushes <version> plus a floating
  latest tag only when the Godot version actually changed
- a workflow_dispatch free-text version input to (re)build any specific
  Godot version on demand, always with newest-at-build-time Blender,
  overwriting that tag without touching latest
- scripts/resolve-godot-version.sh and scripts/resolve-blender-url.sh,
  with shared parsing logic in scripts/lib.sh and an offline smoke test
  in scripts/test-lib.sh
- Blender is now fetched directly from download.blender.org instead of
  apt (Ubuntu noble's apt package is stuck on 4.0.2)
- drop the push-to-main trigger; schedule + workflow_dispatch only

Scope is Godot 4.0+ only — .blend import is a Godot 4 feature, so 3.x
builds have no use for the Blender toolchain this image adds.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/resolve-blender-url.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Prints the download URL of the newest stable Blender linux-x64 release tarball.
+# No official "latest stable" API exists for Blender (only the experimental-builds
+# API does) so this scrapes the release index — see docs/handoff for background.
+# Requires: curl.
+set -euo pipefail
+cd "$(dirname "$0")"
+. ./lib.sh
+
+base="https://download.blender.org/release/"
+minor=$(curl -fsSL "$base" | parse_latest_blender_minor)
+minor_url="${base}Blender${minor}/"
+file=$(curl -fsSL "$minor_url" | parse_latest_blender_tarball)
+
+echo "${minor_url}${file}"