Six sites parse the pubspec version line, with two different regexes

Six sites parse the `version:` line out of `pubspec.yaml`, with two mutually incompatible regexes:

- `build/android.sh:10`, `build/ios.sh:17`, `build/linux.sh:10`, `build/macos.sh:18` — identical `sed -nE 's/^version:[[:space:]]*([0-9A-Za-z._-]+).*/\1/p'`
- `build/windows.ps1:13-17` — the PowerShell equivalent
- `auto-release.yml` (`sync-version`) — `sed -nE 's/^version:[[:space:]]*(.+)[[:space:]]*$/\1/p'`, a *different* pattern for the same line

The four bash scripts additionally repeat a ~10-line `FLUTTER_BIN` resolution block (`android.sh:22-30`, `ios.sh:29-37`, `linux.sh:36-48`, `macos.sh:38-46`) and an identical `ROOT_DIR=` line. `linux.sh:31` hardcodes a specific developer's Flutter path as a fallback.

#36 created the first shared script in `.github/scripts/`; this is the adjacent duplication it deliberately did not absorb, since the PR's scope was the release workflow rather than the build scripts.

- [ ] A `--from-pubspec` mode on `derive_version.sh`, or a small `common.sh`, for the version-line parse
- [ ] Share the `FLUTTER_BIN` resolution
- [ ] Drop the hardcoded path in `linux.sh:31`