fix(build): make the local + CI Linux build work off main (#26)

Three independent gaps currently break a from-scratch Linux build (and CI):

1. .build-config.json is missing `versions.dotnet`, yet both the devcontainer
   Dockerfile (`dotnet-install.sh --channel ${DOTNET_VERSION}`) and the CI
   workflows (`require('./.build-config.json').versions.dotnet` → setup-dotnet
   `${dotnet}.x`) read it. Empty → the image build / setup-dotnet step fails.
   Add `"dotnet": "8.0"` (Velopack's vpk targets .NET 8; "8.0" satisfies both
   `--channel 8.0` and setup-dotnet's `8.0.x`). Keeps .NET available for
   `vpk pack` on tagged release builds.

2. build-linux-docker.sh never forwards GH_CLONE_TOKEN or SLOPSMITH_REF into
   the container, so a local `bash scripts/build-linux-docker.sh` can't clone
   the private got-feedback core/plugins or select a core ref. Pass both
   through (defaulting SLOPSMITH_REF to main).

3. The ffmpeg libvorbis guard pipes `ffmpeg | grep -wq`, which is racy under
   `set -o pipefail`: grep -q closes the pipe on first match, ffmpeg takes
   SIGPIPE (141), pipefail returns 141, and the guard false-fails even though
   libvorbis is present (reproducible on Docker Desktop). Capture the encoder
   list into a variable first, then grep.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.build-config.json

@@ -4,7 +4,8 @@
     "python": "3.12.9",
     "electron": "35.0.0",
     "cmake": "3.22",
-    "ubuntu": "22.04"
+    "ubuntu": "22.04",
+    "dotnet": "8.0"
   },
   "external": {
     "fluidsynth_windows": {

scripts/build-linux-docker.sh

@@ -81,6 +81,8 @@ docker run \
     -e ELECTRON_CACHE=/home/vscode/.cache/electron \
     -e ELECTRON_BUILDER_CACHE=/home/vscode/.cache/electron-builder \
     -e GIT_TERMINAL_PROMPT=0 \
+    -e "GH_CLONE_TOKEN=${GH_CLONE_TOKEN:-}" \
+    -e "SLOPSMITH_REF=${SLOPSMITH_REF:-main}" \
     -t \
     slopsmith-ubuntu-builder \
     bash -c './scripts/build-linux-ubuntu.sh'

scripts/bundle-binaries.sh

@@ -73,7 +73,8 @@ bundle_with_deps() {
 # will hard-fail later if it's missing — fail here with the actual cause
 # rather than letting that downstream check produce a less-direct error.
 if command -v ffmpeg >/dev/null 2>&1; then
-    cp "$(which ffmpeg)" "$BIN_DIR/"
+    FFMPEG_SRC="$(command -v ffmpeg)"
+    cp "$FFMPEG_SRC" "$BIN_DIR/"
     echo " ffmpeg: $(ls -lh "$BIN_DIR/ffmpeg" | awk '{print $5}')"
 else
     echo "ERROR: ffmpeg not found on PATH; resources/bin/ffmpeg is required for the bundled build (apt: ffmpeg / brew: ffmpeg)." >&2
@@ -85,7 +86,14 @@ fi
 # at runtime on user machines. The lib/sloppak_convert.py fallback to
 # the built-in `vorbis -strict experimental` encoder is a safety net for
 # unbundled installs, not a license to ship a libvorbis-less binary.
-if ! "$BIN_DIR/ffmpeg" -hide_banner -encoders 2>/dev/null | grep -wq libvorbis; then
+# Capture the encoder list into a variable BEFORE grepping. Piping ffmpeg
+# straight into `grep -wq` is racy under `set -o pipefail`: grep -q exits on the
+# first match and closes the pipe, ffmpeg then takes SIGPIPE (141) mid-write, and
+# pipefail makes the whole pipeline return 141 instead of grep's 0 — so the guard
+# intermittently "fails" even though libvorbis is present (reproducible on Docker
+# Desktop). Capturing first removes the pipe from ffmpeg entirely.
+FFMPEG_ENCODERS="$("$FFMPEG_SRC" -hide_banner -encoders 2>/dev/null || true)"
+if ! printf '%s\n' "$FFMPEG_ENCODERS" | grep -wq libvorbis; then
     echo "ERROR: bundled ffmpeg lacks libvorbis encoder. Sloppak conversion would fall back to the lower-quality built-in vorbis encoder on user machines." >&2
     echo "Install an ffmpeg built with --enable-libvorbis (apt's ffmpeg ships it by default; check your distro's package if this fails)." >&2
     exit 1