chore: resolve latest bincraft release dynamically

Replace the hardcoded bincraft pin (@vX.Y.Z, repeated across every .crow
workflow and the build-one image) with local/install-bincraft.R, which lists
the remote tags via git ls-remote, picks the highest vX.Y.Z, and installs it
with pak (idempotent on the git ref). Now a new bincraft release is picked up
automatically on the next run -- no more editing the version in many places.

Filtering/sorting is done in R (not git --sort / refspec) for portable
behaviour, and GIT_TERMINAL_PROMPT=0 keeps non-interactive runs from hanging.

docker/build-one.Dockerfile

@@ -16,6 +16,8 @@ ARG CACHEBUST
 
 WORKDIR /work
 COPY build-one.R /work/build-one.R
+# Resolve and install the latest bincraft release dynamically (no hardcoded pin).
+COPY install-bincraft.R /work/install-bincraft.R
 # Ship the patch registry so build-one.R's `patches = "local/patches"` resolves
 # (build context is `local/`, CWD is /work).
 COPY patches /work/local/patches
@@ -43,7 +45,7 @@ RUN --mount=type=secret,id=b2_access,required=true \
       echo "No working virtual display; building without xvfb" >&2; \
     fi; \
     run_build() { if [ "$USE_XVFB" = 1 ]; then $XVFB -a $XVFB_ARGS -- "$@"; else "$@"; fi; }; \
-    ensure_bincraft() { "$1" -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.4.2") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.4.2")'; }; \
+    ensure_bincraft() { "$1" -q -e 'source("/work/install-bincraft.R")'; }; \
     PRIMARY_MINOR=$(echo "$R_VERSION" | cut -d. -f1-2); \
     seen=" $PRIMARY_MINOR "; \
     prc=0; failed=""; \