refactor(ci): pin bincraft and skip reinstall when version matches

bincraft is baked into the build-env images, but every workflow run
unconditionally called pak::pak("git::.../bincraft.git"), costing
~30-60s per job.

Pin the install URL to a specific tag (v4.0.2) and guard the install
on packageVersion("bincraft") != "4.0.2". Healthy images skip the
install entirely; broken images and version drift still self-heal.

Adds a Renovate customManager so the pin is bumped automatically
when bincraft cuts a new tag.

renovate.json

@@ -5,5 +5,19 @@
   ],
   "ignorePaths": [
     "docker/**"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.crow/.*\\.yaml$"],
+      "matchStrings": [
+        "packageVersion\\(\"bincraft\"\\) != \"(?<currentValue>[0-9.]+)\"",
+        "bincraft\\.git@v(?<currentValue>[0-9.]+)"
+      ],
+      "depNameTemplate": "bincraft",
+      "packageNameTemplate": "https://codefloe.com/rpkgs/bincraft.git",
+      "datasourceTemplate": "git-tags",
+      "extractVersionTemplate": "^v?(?<version>.+)$"
+    }
   ]
 }