fix(ci): take the Go version from go.mod

setup-go v7 exports GOTOOLCHAIN=local, so Go no longer downloads the
toolchain a module asks for — whatever setup-go installed has to satisfy
it. `go-version: '1.26'` resolves to the runner manifest's patch, which
is 1.26.5, against modules requiring 1.26.6 since this morning's CVE
bump. The parser tests stopped on that.

go-version-file installs exactly what the modules declare, and removes
the fourth place a Go version was written down.

.github/workflows/deploy-pages.yml

@@ -28,9 +28,15 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      # The version comes from go.mod rather than a literal here. setup-go sets
+      # GOTOOLCHAIN=local, so Go will not fetch the toolchain a module asks for
+      # — the one installed has to satisfy it. A literal '1.26' resolves to
+      # whatever patch the runner manifest has, which was 1.26.5 against a
+      # go.mod requiring 1.26.6, and the build stopped there. All three modules
+      # are bumped together, so parser/go.mod speaks for them.
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version-file: parser/go.mod
           cache-dependency-path: |
             parser/go.sum
             crawler/go.sum