chore: resolve latest bincraft release dynamically (no hardcoded pins) (#107)

## Summary

Stop hardcoding the bincraft version. Every `.crow` workflow and the build-one image pinned `@vX.Y.Z` (and a `packageVersion() != "X.Y.Z"` guard), so each bincraft release meant editing the version in ~8 places — and it was easy to miss one (the Dockerfile lagged at v4.2.1; v4.4.1 shipped without the empty-env fix because of exactly this churn).

## Change

New `local/install-bincraft.R` resolves the **latest release tag dynamically**:

- `git ls-remote --tags` on the public repo (no token),
- keep `vX.Y.Z` tags, pick the highest version (filtered/sorted in R for portability, not via git `--sort`/refspec which behaved inconsistently under `system2()`),
- `pak::pak("git::…@<latest>")` — idempotent on the git ref, so re-runs keep the package unless a newer tag exists.

All call sites now invoke the helper instead of a pinned version:

- `.crow/build-all-versions.yaml` (primary + per-minor pass)
- `.crow/build-all-versions-install-deps.yaml`
- `.crow/process-updates.yaml` (primary + per-minor pass)
- `.crow/weekly-rebuild-missing.yaml`
- `.crow/archive-missed-packages.yaml`
- `docker/build-one.Dockerfile` (ships the helper into the image; `ensure_bincraft` sources it)

## Effect

Tag a new bincraft release → the next CI run / `just rebuild` picks it up automatically. No more pin edits, and no more "forgot to bump the Dockerfile" drift.

## Verified

- Resolver returns the current latest tag (`v4.4.2`) via `git ls-remote` + R-side version sort.
- All five workflow YAMLs parse; helper R parses; air/editorconfig clean.

Note: this tracks the latest **tag**, so cutting a release is still the deliberate gate — CI won't pick up un-tagged main.
Reviewed-on: #107

local/install-bincraft.R

@@ -0,0 +1,52 @@
+#!/usr/bin/env Rscript
+
+# Install the latest tagged bincraft release, resolved dynamically, so the CI
+# workflows and the build-one image never pin a hardcoded version (no more
+# editing `@vX.Y.Z` in many places on every release).
+#
+# Run with the R whose library should receive bincraft:
+#   Rscript local/install-bincraft.R
+# or, to target a specific R from a shell loop:
+#   "$RBIN" -q -e 'source("local/install-bincraft.R")'
+#
+# How it works: list the remote tags with `git ls-remote` (no token needed for
+# the public repo), keep the `vX.Y.Z` release tags, pick the highest version,
+# and install it with pak. pak is idempotent on the git ref, so re-running keeps
+# the package when it is already current and only updates when a newer tag ships.
+# Filtering/sorting is done in R (not via git's `--sort`/refspec) so behaviour is
+# identical across git versions and `system2()` argument handling.
+
+repo_url <- Sys.getenv(
+  "BINCRAFT_GIT_URL",
+  unset = "https://codefloe.com/rpkgs/bincraft.git"
+)
+
+# GIT_TERMINAL_PROMPT=0 keeps a non-interactive run from hanging on auth.
+refs <- system2(
+  "git",
+  c("ls-remote", "--tags", repo_url),
+  stdout = TRUE,
+  stderr = FALSE,
+  env = "GIT_TERMINAL_PROMPT=0"
+)
+tags <- sub(".*refs/tags/", "", refs)
+tags <- tags[!grepl("\\^\\{\\}$", tags)] # drop dereferenced "...^{}" lines
+tags <- grep("^v[0-9]", tags, value = TRUE) # only vX.Y.Z release tags
+if (length(tags) == 0L) {
+  stop(
+    "Could not resolve any bincraft release tag from ",
+    repo_url,
+    call. = FALSE
+  )
+}
+latest <- tags[order(package_version(sub("^v", "", tags)), decreasing = TRUE)][
+  1L
+]
+
+message(sprintf("Installing latest bincraft release: %s", latest))
+pak::pak(sprintf("git::%s@%s", repo_url, latest))
+message(sprintf(
+  "bincraft %s installed (%s)",
+  as.character(utils::packageVersion("bincraft")),
+  latest
+))