Pin protoc so the build is reproducible

[psobot]

Problem

Building the generated code needed a protoc on $PATH, unpinned. protoc 25+ embeds a runtime-version check into its output that refuses to load under an older google.protobuf than the one it was built against — so a contributor with a current Homebrew protoc (35.x) gets generated code that won't import in the same virtualenv that just built it:

google.protobuf.runtime_version.VersionError: Detected incompatible Protobuf
Gencode/Runtime versions ... gencode 7.35.1 runtime 6.32.1

That reads as "this repo is broken" rather than "your protoc is too new". Combined with the README pointing at a dumper/Makefile that has never existed, this is #67.

Fix

dumper/run.py downloads and uses a pinned protoc 21.9 — the version CI already used — into .protoc/, and deliberately does not fall back to $PATH.

21.9 predates the runtime-version check, which keeps protobuf>=3.13.0 an honest floor for end users. Pinning a modern protoc instead would have forced every installed user up to protobuf>=5.28.1; that's a separate decision, not a side effect of fixing the build.

--protoc /path/to/protoc overrides.

Also in here

• dumper.protodump is now imported lazily. It depends on Protobuf internals removed in protobuf 4 (SkipField), and importing it at module scope made even the compile-only path — which needs none of that — fail on a modern protobuf. Recompiling the checked-in protos now works on any supported protobuf; only the --app-path extraction step still needs protobuf<4, which is documented and declared in the script header.
• check=True on the protoc call. A protoc failure previously left a half-populated gencode directory and let the build carry on.
• Workflow cleanup: removed the now-redundant protoc download, the ::set-env command (disabled by GitHub since 2020, kept alive only by ACTIONS_ALLOW_UNSECURE_COMMANDS), and a pip install protobuf>=4 that contradicted the protobuf<4 pin installed two lines later.
• README: documents rebuilding gencode and adding a new Keynote version, replacing the cd dumper && make clean && make instructions.

Verification

From a clean tree with no .protoc/ and no gencode, under protobuf==6.32.1 (which failed before this change):

INFO  Downloading protoc 21.9 from ...
INFO  Using protoc: .../.protoc/21.9/bin/protoc
INFO  Done!
20 passed

Second run reuses the cached protoc without re-downloading.

Fixes #67.