[codex] secure Ruby version automation

[gauravtiwari]

What changed

• Reworks the scheduled Ruby version checker to update versions.yml through a bot-authored PR instead of relying on the default GITHUB_TOKEN to create PRs.
• Adds scripts/update-ruby-versions.py so version discovery, EOL pruning, and priority rotation are testable outside a workflow heredoc.
• Updates tracked Ruby patches to the latest ruby-build definitions currently seen by the updater: 4.0.4, 4.0.3, 4.0.2; 3.4.9, 3.4.8, 3.4.7; 3.3.11, 3.3.10, 3.3.9.
• Adds a stable Build Status job so branch protection can require one predictable check for the matrix build.

Why

The failed scheduled run pushed auto/ruby-version-bump but failed when creating the PR because repository Actions settings do not allow the default GITHUB_TOKEN to create PRs. This keeps main protected and moves write operations to the same BOT_PUBLIC_GITHUB_TOKEN pattern used by the benchmark sync repos.

Validation

• python3 -m py_compile scripts/update-ruby-versions.py
• python3 scripts/update-ruby-versions.py
• Ruby YAML parse of versions.yml, .github/workflows/check-ruby-versions.yml, and .github/workflows/build-ruby.yml
• git diff --check

Follow-up

boringcache/ruby does not currently expose BOT_PUBLIC_GITHUB_TOKEN as a repo or inherited org secret, so the scheduled checker needs that secret enabled before the bot PR step can run.