Fix CI: json-c for crun, and fetch crun's git submodules as pinned tarballs

Verified end-to-end with a full local build of all 8 packages on the
actual runner host (docker exec against vbatts/slackware:15.0, bind-
mounted repo on the cache pool) instead of round-tripping through
Gitea Actions for each fix — much faster for a chain of issues this
deep. All 8 packages now build successfully from a clean checkout.

Three fixes, all in crun (the last package still failing):

1. "Package requirements (json-c >= 0.14) were not met" — added
   json-c to the toolchain bootstrap.

2. crun depends on the libocispec git submodule, which in turn depends
   on the image-spec and runtime-spec git submodules. GitHub's source
   archive tarball never includes submodule content (no .git directory
   for `git submodule update` to work against — the existing `|| true`
   masked this failing silently). Fetched all three as their own
   pinned tarballs instead, at the exact commits crun 1.28 references
   (cross-checked via the GitHub contents API), matching how every
   other dependency in this project is already pinned.

3. crun.c unconditionally #includes git-version.h, which crun's own
   Makefile only generates via `git describe` (again, no .git) or from
   a pre-existing .tarball-git-version.h — the file crun's own `make
   dist` would have written, which we never run. Write that file
   ourselves in the exact format the Makefile already expects; this is
   the documented fallback path bundled release tarballs rely on, not
   a workaround around it.

Also includes the podman go-md2man pre-seed fix and setup-slackware-
buildenv.sh python3 addition from the previous commit's follow-up
testing (both already verified working in this same local build run).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/crun/crun.SlackBuild

@@ -37,13 +37,41 @@ done
 
 cd "$srcdir"
 
-# GitHub's source archive does not include vendored git submodules
-# (libocispec) that crun's release tarballs normally bundle; init/update
-# them explicitly.
-if [ -f .gitmodules ]; then
-  echo "==> [crun] fetching submodules"
-  git -c protocol.file.allow=always submodule update --init --recursive || true
-fi
+# GitHub's source archive has no .git directory, so `git submodule
+# update` can never work against it (it needs an actual git repo to
+# resolve against) — it silently fails and leaves libocispec/ empty,
+# which only surfaces much later as a confusing "No rule to make target
+# 'all'" in that subdirectory. Fetch libocispec as its own pinned source
+# instead, matching every other dependency in this project, and unpack it
+# directly over the empty submodule directory.
+echo "==> [crun] fetching libocispec (git submodule, pinned separately — see versions.env)"
+libocispec_tarball=$(sb_fetch_and_verify "$LIBOCISPEC_SRC_URL" "$LIBOCISPEC_SRC_SHA256" "libocispec-$LIBOCISPEC_COMMIT.tar.gz")
+rm -rf "$srcdir/libocispec"
+mkdir -p "$srcdir/libocispec"
+tar -xf "$libocispec_tarball" -C "$srcdir/libocispec" --strip-components=1
+
+# libocispec has its own two git submodules (image-spec, runtime-spec) —
+# same problem, one level deeper. Same fix, same reasoning.
+echo "==> [crun] fetching libocispec's image-spec/runtime-spec submodules"
+imagespec_tarball=$(sb_fetch_and_verify "$IMAGE_SPEC_SRC_URL" "$IMAGE_SPEC_SRC_SHA256" "image-spec-$IMAGE_SPEC_COMMIT.tar.gz")
+rm -rf "$srcdir/libocispec/image-spec"
+mkdir -p "$srcdir/libocispec/image-spec"
+tar -xf "$imagespec_tarball" -C "$srcdir/libocispec/image-spec" --strip-components=1
+
+runtimespec_tarball=$(sb_fetch_and_verify "$RUNTIME_SPEC_SRC_URL" "$RUNTIME_SPEC_SRC_SHA256" "runtime-spec-$RUNTIME_SPEC_COMMIT.tar.gz")
+rm -rf "$srcdir/libocispec/runtime-spec"
+mkdir -p "$srcdir/libocispec/runtime-spec"
+tar -xf "$runtimespec_tarball" -C "$srcdir/libocispec/runtime-spec" --strip-components=1
+
+# crun.c unconditionally #includes git-version.h. Its own Makefile only
+# generates that file from `git describe` (needs .git, which a plain
+# tarball checkout never has) or, failing that, from a pre-existing
+# .tarball-git-version.h — the file crun's own `make dist` would have
+# written. We're not running `make dist`, so write it ourselves in the
+# exact format that Makefile target expects; this is the documented
+# fallback path, not a workaround around it.
+printf '/* autogenerated.  */\n#ifndef GIT_VERSION\n# define GIT_VERSION "%s"\n#endif\n' "$VERSION" \
+  > .tarball-git-version.h
 
 echo "==> [crun] autogen + configure"
 ./autogen.sh