feat: dynamically resolve latest upstream

[treyturner]

Summary

• Removes the hardcoded CRAWL_TAG version from all CI workflows and the Dockerfile, replacing it with dynamic resolution of the latest upstream release at build time
• When CRAWL_TAG is omitted, the builder stage queries the GitHub Releases API (/repos/crawl/crawl/releases/latest) to resolve the tag, writes it to /tmp/crawl-tag, and copies it into the runtime image at /app/crawl-tag
• The build action now runs Docker Buildx before tag computation, then reads the resolved version from the built image to drive tagging — eliminating the chicken-and-egg dependency between tag resolution and the build step
• Removes the cache-scope / cache-fallback-scope inputs; cache scope is now derived directly from upstream-ref (or 'latest' when omitted)
• Drops the per-run unique traceability tag (<version>-dev-<run_id>.<attempt>) to simplify the tag surface
• Removes CRAWL_TAG as a runtime ENV variable; the entrypoint now reads it from /app/crawl-tag at startup
• Strips the v prefix from all version tags and workflow inputs (e.g. 0.34.1 instead of v0.34.1) for consistency

Test plan

• Open a PR and verify the build-and-test-pr workflow completes without an explicit upstream-ref, confirming the latest DCSS release is resolved automatically
• Confirm the test step validates CRAWL_TAG by reading /app/crawl-tag from the built image
• Trigger build-and-publish without an upstream-ref input and verify the published image is tagged with the resolved version (e.g. 0.34.1-dev)
• Trigger build-and-publish with an explicit upstream-ref (e.g. 0.34.0) and verify that version is used instead of latest
• Run promote-tag with a bare version string (e.g. 0.34.1) and confirm validation accepts it and rejects the old v-prefixed format
• Build locally without --build-arg CRAWL_TAG and verify the image resolves and bakes in the latest tag