nightly-{dmg,linux}: split upstream Firefox version from release version

[mdheller]

Why (root cause from #147's silent failure)

#147 added `inputs.version` to both nightly workflows so a release cut could pass `version=150.0.6`. It didn't work: the DMG dispatch failed immediately in "Fetch Firefox source tarball" because it tried to `cd build/workspaces/human-secure-150.0.6-1/source` — a directory that doesn't exist because Firefox source is pinned upstream at 150.0.1.

The `VERSION` env is conflated. It's simultaneously:

• pinned UPSTREAM Firefox tarball version (workspace paths, cache keys, source URL)
• our RELEASE version (Info.plist, artifact filename)

Overriding it to 150.0.6 breaks the first meaning without helping the second.

Change

Split into two envs:

• `VERSION` = pinned upstream Firefox tarball (`150.0.1`, immutable)
• `BEARBROWSER_VERSION` = what WE ship as (defaults to `VERSION`; override via `workflow_dispatch` input `release_version`)

Only three call sites use `BEARBROWSER_VERSION`:

1. `--version` arg to `bearbrowser-package-source-build.sh` (goes into Info.plist)
2. `--version` arg to `package-linux-appimage.sh`
3. Artifact filename (`BearBrowser-<BEARBROWSER_VERSION>--dev.dmg` / `…-.tar.xz`)

Everything else keeps the pinned upstream `VERSION`.

Release cut becomes

```
gh workflow run nightly-dmg.yml --ref main -f release_version=150.0.6
gh workflow run nightly-linux.yml --ref main -f release_version=150.0.6
```

Adversarial-review checklist

• Sensitive network fetches — N/A
• String parsers — N/A
• Packaged-artifact assertions — the plist-version gate catches the class of failure this PR closes
• `FINAL_TARGET_FILES` blocks — N/A
• Auth / IAM changes — N/A
• Version metadata — this IS the fix. Comment in the env block explains the two-tier version scheme so nobody re-conflates them
• Silent-skip guards — no silent skips; the `inputs.release_version != '' && inputs.release_version || '150.0.1'` fallback is deterministic
• Firefox/Mozilla/LibreWolf strings — none added

Test plan

Post-merge, dispatch both nightlies with `release_version=150.0.6` and:

• Confirm the workspace-path steps still find their dir (they will — VERSION stays 150.0.1)
• Confirm shipped artifact filenames contain `150.0.6`
• Confirm extracted DMG Info.plist `CFBundleShortVersionString == 150.0.6`
• Cut v150.0.6 release, watch promotion-gate green

Blast radius

Additive — no existing trigger path changes behaviour. Non-dispatch triggers (schedule, push) still ship the nightly `150.0.1` default.