feat: auto-track newest Godot and Blender in publish workflow

Replace the fixed 4.7.1 Dockerfile/workflow pin with:
- a nightly schedule that resolves the newest stable Godot (4.0+) and
  newest stable Blender, and builds+pushes <version> plus a floating
  latest tag only when the Godot version actually changed
- a workflow_dispatch free-text version input to (re)build any specific
  Godot version on demand, always with newest-at-build-time Blender,
  overwriting that tag without touching latest
- scripts/resolve-godot-version.sh and scripts/resolve-blender-url.sh,
  with shared parsing logic in scripts/lib.sh and an offline smoke test
  in scripts/test-lib.sh
- Blender is now fetched directly from download.blender.org instead of
  apt (Ubuntu noble's apt package is stuck on 4.0.2)
- drop the push-to-main trigger; schedule + workflow_dispatch only

Scope is Godot 4.0+ only — .blend import is a Godot 4 feature, so 3.x
builds have no use for the Blender toolchain this image adds.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/test-lib.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Offline smoke test for lib.sh's parsing logic (no network). Run: ./scripts/test-lib.sh
+set -euo pipefail
+cd "$(dirname "$0")"
+. ./lib.sh
+
+fail() { echo "FAIL: $1" >&2; exit 1; }
+
+# parse_latest_godot_tag: skips prereleases and drafts, strips "-stable"
+# (needs jq — present on the CI runner; skipped here if this machine lacks it)
+if command -v jq >/dev/null 2>&1; then
+  got=$(printf '%s' '[
+    {"tag_name":"4.8-rc1","prerelease":true,"draft":false},
+    {"tag_name":"4.7.1-stable","prerelease":false,"draft":false},
+    {"tag_name":"4.7-stable","prerelease":false,"draft":false},
+    {"tag_name":"4.8-dev-draft","prerelease":false,"draft":true}
+  ]' | parse_latest_godot_tag)
+  [ "$got" = "4.7.1" ] || fail "parse_latest_godot_tag: got '$got', want 4.7.1"
+else
+  echo "skip: parse_latest_godot_tag (jq not installed on this machine)" >&2
+fi
+
+# parse_latest_blender_minor: numeric sort, not lexicographic ("4.10" > "4.2")
+got=$(printf '%s' '<a href="Blender3.6/">Blender3.6/</a> <a href="Blender4.2/">Blender4.2/</a> <a href="Blender4.10/">Blender4.10/</a>' \
+  | parse_latest_blender_minor)
+[ "$got" = "4.10" ] || fail "parse_latest_blender_minor: got '$got', want 4.10"
+
+# parse_latest_blender_tarball: newest patch, ignores sha256 sidecars and other OSes
+got=$(printf '%s' '<a href="blender-4.2.1-linux-x64.tar.xz">x</a>
+<a href="blender-4.2.10-linux-x64.tar.xz">x</a>
+<a href="blender-4.2.10-linux-x64.tar.xz.sha256">x</a>
+<a href="blender-4.2.10-windows-x64.zip">x</a>' | parse_latest_blender_tarball)
+[ "$got" = "blender-4.2.10-linux-x64.tar.xz" ] || fail "parse_latest_blender_tarball: got '$got', want blender-4.2.10-linux-x64.tar.xz"
+
+echo "ok: scripts/lib.sh"