deps: centralize toolchain pins (Alpine, macOS target, Python) in versions.env

[ccomb]

Summary

versions.env was only the source of truth for MUMPS / OpenBLAS / GHC. Other toolchain pins (Alpine base image, MACOSX_DEPLOYMENT_TARGET, Python version) were duplicated as literals across the Dockerfile, three build/prebuild workflows, two pyvolca workflows, and three shell scripts.

A real drift case just hit us: docker/Dockerfile pinned OPENBLAS_VERSION=0.3.27 as an ARG default while versions.env had moved to 0.3.33, so ./docker-build.sh silently kept building the older release until a fresh container build failed unrelatedly. This PR makes versions.env the single source for every toolchain pin so the next bump is a one-line edit.

Changes

• Dockerfile sources OPENBLAS_VERSION from /tmp/versions.env (same pattern MUMPS_VERSION already used). ALPINE_VERSION is an ARG with no default — docker/docker-build.sh sources versions.env and passes --build-arg. No default on purpose: a stale default is exactly how OpenBLAS drifted.
• _build-matrix.yml, prebuild-mumps.yml, prebuild-cabal-store.yml each gain a tiny versions job that reads versions.env and exposes alpine + macos_target as job outputs. The build matrix references those at job level for container: and the workflow-level MACOSX_DEPLOYMENT_TARGET env. matrix.container is gone; if: matrix.os == 'linux' replaces the brittle matrix.container == 'alpine:3.23' string compare.
• pyvolca.yml and pyvolca-release.yml gain the same versions job and reference its python output for setup-python.
• build.sh, build-mumps.sh, gen-cabal-config.sh replace the ${MACOSX_DEPLOYMENT_TARGET:-13.0} fallbacks with :?, so a standalone invocation without sourcing versions.env now fails fast with a clear message instead of silently reverting to a stale default.

Test plan

• Locally: ./deploy.sh ecobalyse rebuilds the volca-with-frontend image cleanly (this is what surfaced the OpenBLAS drift in the first place).
• CI: re-run prebuild-mumps.yml, prebuild-cabal-store.yml, and the build matrix to confirm the new versions job + container wiring work end-to-end.
• CI: re-run pyvolca.yml to confirm python-version resolves to 3.12 via the versions job.

Downstream

Consumers of docker/Dockerfile outside this repo must source versions.env and pass --build-arg ALPINE_VERSION=... themselves (the docker-build.sh wrapper here already does it). For volca-deploy/, the matching follow-up is at ccomb/volca-deploy#16.