bincraft is baked into the build-env images, but every workflow run
unconditionally called pak::pak("git::.../bincraft.git"), costing
~30-60s per job.
Pin the install URL to a specific tag (v4.0.2) and guard the install
on packageVersion("bincraft") != "4.0.2". Healthy images skip the
install entirely; broken images and version drift still self-heal.
Adds a Renovate customManager so the pin is bumped automatically
when bincraft cuts a new tag.