chore: resolve latest bincraft release dynamically

Replace the hardcoded bincraft pin (@vX.Y.Z, repeated across every .crow
workflow and the build-one image) with local/install-bincraft.R, which lists
the remote tags via git ls-remote, picks the highest vX.Y.Z, and installs it
with pak (idempotent on the git ref). Now a new bincraft release is picked up
automatically on the next run -- no more editing the version in many places.

Filtering/sorting is done in R (not git --sort / refspec) for portable
behaviour, and GIT_TERMINAL_PROMPT=0 keeps non-interactive runs from hanging.

local/install-bincraft.R

@@ -0,0 +1,52 @@
+#!/usr/bin/env Rscript
+
+# Install the latest tagged bincraft release, resolved dynamically, so the CI
+# workflows and the build-one image never pin a hardcoded version (no more
+# editing `@vX.Y.Z` in many places on every release).
+#
+# Run with the R whose library should receive bincraft:
+#   Rscript local/install-bincraft.R
+# or, to target a specific R from a shell loop:
+#   "$RBIN" -q -e 'source("local/install-bincraft.R")'
+#
+# How it works: list the remote tags with `git ls-remote` (no token needed for
+# the public repo), keep the `vX.Y.Z` release tags, pick the highest version,
+# and install it with pak. pak is idempotent on the git ref, so re-running keeps
+# the package when it is already current and only updates when a newer tag ships.
+# Filtering/sorting is done in R (not via git's `--sort`/refspec) so behaviour is
+# identical across git versions and `system2()` argument handling.
+
+repo_url <- Sys.getenv(
+  "BINCRAFT_GIT_URL",
+  unset = "https://codefloe.com/rpkgs/bincraft.git"
+)
+
+# GIT_TERMINAL_PROMPT=0 keeps a non-interactive run from hanging on auth.
+refs <- system2(
+  "git",
+  c("ls-remote", "--tags", repo_url),
+  stdout = TRUE,
+  stderr = FALSE,
+  env = "GIT_TERMINAL_PROMPT=0"
+)
+tags <- sub(".*refs/tags/", "", refs)
+tags <- tags[!grepl("\\^\\{\\}$", tags)] # drop dereferenced "...^{}" lines
+tags <- grep("^v[0-9]", tags, value = TRUE) # only vX.Y.Z release tags
+if (length(tags) == 0L) {
+  stop(
+    "Could not resolve any bincraft release tag from ",
+    repo_url,
+    call. = FALSE
+  )
+}
+latest <- tags[order(package_version(sub("^v", "", tags)), decreasing = TRUE)][
+  1L
+]
+
+message(sprintf("Installing latest bincraft release: %s", latest))
+pak::pak(sprintf("git::%s@%s", repo_url, latest))
+message(sprintf(
+  "bincraft %s installed (%s)",
+  as.character(utils::packageVersion("bincraft")),
+  latest
+))