Fix CI: json-c for crun, and fetch crun's git submodules as pinned tarballs

Verified end-to-end with a full local build of all 8 packages on the
actual runner host (docker exec against vbatts/slackware:15.0, bind-
mounted repo on the cache pool) instead of round-tripping through
Gitea Actions for each fix — much faster for a chain of issues this
deep. All 8 packages now build successfully from a clean checkout.

Three fixes, all in crun (the last package still failing):

1. "Package requirements (json-c >= 0.14) were not met" — added
   json-c to the toolchain bootstrap.

2. crun depends on the libocispec git submodule, which in turn depends
   on the image-spec and runtime-spec git submodules. GitHub's source
   archive tarball never includes submodule content (no .git directory
   for `git submodule update` to work against — the existing `|| true`
   masked this failing silently). Fetched all three as their own
   pinned tarballs instead, at the exact commits crun 1.28 references
   (cross-checked via the GitHub contents API), matching how every
   other dependency in this project is already pinned.

3. crun.c unconditionally #includes git-version.h, which crun's own
   Makefile only generates via `git describe` (again, no .git) or from
   a pre-existing .tarball-git-version.h — the file crun's own `make
   dist` would have written, which we never run. Write that file
   ourselves in the exact format the Makefile already expects; this is
   the documented fallback path bundled release tarballs rely on, not
   a workaround around it.

Also includes the podman go-md2man pre-seed fix and setup-slackware-
buildenv.sh python3 addition from the previous commit's follow-up
testing (both already verified working in this same local build run).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

versions.env

@@ -37,6 +37,31 @@ CRUN_VERSION="1.28"
 CRUN_SRC_URL="https://github.com/containers/crun/archive/refs/tags/${CRUN_VERSION}.tar.gz"
 CRUN_SRC_SHA256="90284c7f097f8ee72a6447978c263e1b1355727c2f2ca0ac667e6d57788f46f5"
 
+# crun's build depends on the libocispec git submodule, which GitHub's
+# source archive (fetched above) never includes — a plain tarball has no
+# .git directory for `git submodule update` to work against, so that has
+# to be fetched as its own separate pinned source instead. Commit pinned
+# to exactly what crun 1.28 references (verified via
+# `curl https://api.github.com/repos/containers/crun/contents/libocispec?ref=1.28`);
+# re-derive it the same way whenever CRUN_VERSION changes.
+LIBOCISPEC_COMMIT="8034d0ecd27f646ba3ffae5ff24db234ce062825"
+LIBOCISPEC_SRC_URL="https://github.com/containers/libocispec/archive/${LIBOCISPEC_COMMIT}.tar.gz"
+LIBOCISPEC_SRC_SHA256="3e9170e54ddf487dc087ff1b88d0722e134a206cf36bba87cc946819ccf036ab"
+
+# libocispec itself has two more git submodules (same problem, one level
+# deeper) — its own generate.py needs both schema trees present at build
+# time. Commits pinned to exactly what the LIBOCISPEC_COMMIT above
+# references (verified the same way, via
+# `curl https://api.github.com/repos/containers/libocispec/contents/image-spec?ref=$LIBOCISPEC_COMMIT`
+# and .../runtime-spec?ref=...).
+IMAGE_SPEC_COMMIT="26647a49f642c7d22a1cd3aa0a48e4650a542269"
+IMAGE_SPEC_SRC_URL="https://github.com/opencontainers/image-spec/archive/${IMAGE_SPEC_COMMIT}.tar.gz"
+IMAGE_SPEC_SRC_SHA256="8668357de6a1162220b2d1fb654a4182a55844b90ad2774c3b99640eec7e2f54"
+
+RUNTIME_SPEC_COMMIT="d64c1d945da7cf6970061c7c9ff4391fafdf2a15"
+RUNTIME_SPEC_SRC_URL="https://github.com/opencontainers/runtime-spec/archive/${RUNTIME_SPEC_COMMIT}.tar.gz"
+RUNTIME_SPEC_SRC_SHA256="1698ebaa7ff07f8409c084fe9539d0391820e71b7a6e6d877aa1ce8b383a4b50"
+
 # --- netavark --------------------------------------------------------------
 # https://github.com/containers/netavark
 NETAVARK_VERSION="2.0.0"