ci: pin competitive-verifier>=4.1.2; drop polyfill head-custom override

The CI setup action installed competitive-verifier unpinned. Older releases
(incl. the locally used 3.3.1) ship _includes/head-custom.html with a
https://polyfill.io/v3/polyfill.min.js script; that domain was sold in 2024
and serves malicious payloads. 4.1.2 removed it.

Pin a >=4.1.2 floor in all setup steps so the polyfill-free version is
guaranteed, and remove the now-redundant head-custom.html override.

Author: adamant-pwn

.github/workflows/publish.yml

@@ -91,6 +91,9 @@ jobs:
       - name: Set up competitive-verifier
         uses: adamant-pwn/actions/setup@patch-1
         with:
+          # Floor pins the first release without the malicious polyfill.io
+          # script (removed in competitive-verifier 4.1.2).
+          package: "competitive-verifier>=4.1.2"
           cache-pip: false
 
       - name: Docs

.github/workflows/verify.yml

@@ -32,6 +32,9 @@ jobs:
       - name: Set up competitive-verifier
         uses: adamant-pwn/actions/setup@patch-1
         with:
+          # Floor pins the first release without the malicious polyfill.io
+          # script (removed in competitive-verifier 4.1.2).
+          package: "competitive-verifier>=4.1.2"
           cache-pip: true
 
       # Initialize your own environment for resolving.
@@ -119,6 +122,9 @@ jobs:
       - name: Set up competitive-verifier
         uses: adamant-pwn/actions/setup@patch-1
         with:
+          # Floor pins the first release without the malicious polyfill.io
+          # script (removed in competitive-verifier 4.1.2).
+          package: "competitive-verifier>=4.1.2"
           cache-pip: true
       - name: Use GCC 14.2
         run: |
@@ -188,6 +194,9 @@ jobs:
       - name: Set up competitive-verifier
         uses: adamant-pwn/actions/setup@patch-1
         with:
+          # Floor pins the first release without the malicious polyfill.io
+          # script (removed in competitive-verifier 4.1.2).
+          package: "competitive-verifier>=4.1.2"
           cache-pip: true
 
       - name: Merge results