design: drop the version setting, track the latest Deno release

[TomChv]

Design doc only — no code. Replaces #2
(automatic version bumps), which we closed in favour of resolving "latest" at
call time inside the module.

Idea

Delete the version setting. A @cache(ttl: "168h") function does a bare
container.from("denoland/deno:alpine"); the mutable tag resolves to a digest
once and the engine holds that resolved container for a week, so it rolls forward
on its own — no bump PRs, no GitHub Action, no secrets. base becomes a nullable
setting (unset = track latest, set = exact pin), resolved in a toolchain
computed field via a self call. version survives as a read-only report.

pub base: Container = null

let toolchain: Container! {
  base ?? Deno.latestImage.withoutEntrypoint.withEnvVariable("DENO_NO_UPDATE_CHECK", "1")
}

@cache(ttl: "168h")
pub latestImage: Container! { container.from("denoland/deno:alpine") }

Verified working on main (@ 1862b24f)

Self calls work with this repo's dagger-module.toml + dang runtime setup —
no experimental flag, no legacy dagger.json. Two things have to be right:

• Call the type, not the constructor: Deno.latestImage resolves;
  deno.latestImage fails Error: "deno" not found. (Earlier revisions of this
  doc wrongly concluded self calls were disabled for TOML modules — that was this
  typo, now retracted.)
• Resolve in a body, not a field default: a = default with a self call
  hangs on read, so base stays a plain setting resolved in toolchain.

Tested end to end with the real deno module and a standalone repro. @cache(ttl:)
compiles to a real TTL; base ?? Deno.latestImage… returns the latest image when
base is unset.

Still to confirm (§7)

• base override when nullable (unset path verified; --base/settings override not yet)
• TTL actually reused across calls; correct mutable tags (:alpine / :bin); 7d vs 24h.

Also covers

• deno.dang / deno-project.dang / deno-workspace.dang changes (the -A
  fallback and supportsPermissionSets go away once the default is always latest).
• The docs/current_docs/modules/deno.mdx rewrite in dagger/dagger: drop the
  version setting bullet, the dagger settings deno version snippet and the
  "mutually exclusive" line; document pinning via base.
• Honest limits (§5): the function cache is per engine, so this is a freshness
  control, not a lockfile — cold CI engines resolve latest every run.