Consolidate the Hugo version onto a single source of truth (22 hardcoded sites)

[CamSoper]

Upgrading Hugo currently means editing 22 places. Miss one and the failure is quiet: a workflow silently runs a different Hugo than the rest, or make ensure warns every contributor about a version mismatch.

This came out of #21060, which made the hugo-resources cache key derive itself from the installed binary rather than restating the version. That removed the cache keys from this problem but not the underlying pin sprawl.

The 22 sites

hugo-version: pins in workflows (19)

File	Line
.github/workflows/build-and-deploy.yml	63
.github/workflows/check-links.yml	45
.github/workflows/check-search-urls.yml	35
.github/workflows/content-review-article.yml	135
.github/workflows/pull-request.yml	49
.github/workflows/pulumi-cli-docs.yml	114
.github/workflows/pulumi-esc-sdk-dotnet-docs.yml	99
.github/workflows/pulumi-esc-sdk-python-docs.yml	80
.github/workflows/pulumi-esc-sdk-typescript-docs.yml	103
.github/workflows/pulumi-policy-sdk-python-docs.yml	80
.github/workflows/pulumi-policy-sdk-typescript-docs.yml	99
.github/workflows/pulumi-sdk-dotnet-docs.yml	102
.github/workflows/pulumi-sdk-java-docs.yml	101
.github/workflows/pulumi-sdk-python-docs.yml	80
.github/workflows/pulumi-sdk-typescript-docs.yml	88
.github/workflows/review-existing-content.yml	199
.github/workflows/scheduled-test.yml	168
.github/workflows/scheduled-upgrade-programs.yml	89
.github/workflows/testing-build-and-deploy.yml	40

Outside the workflows (3)

• mise.toml:11 — hugo = { version = "0.157.0", os = ["linux"] }
• mise.toml:12 — "asdf:NeoHsu/asdf-hugo" = { version = "extended_0.157.0", os = ["macos"] }
• scripts/ensure.sh:40 — the check_version "Hugo" … "0.157.0" guard

Reproduce with:

grep -rn "0\.157\.0" --include="*.yml" --include="*.yaml" --include="*.toml" --include="*.sh" --include="Makefile" . | grep -v node_modules

Why it matters

The two failure modes differ in loudness, and neither is loud enough:

• A missed workflow pin means that job runs a different Hugo than everything else. It may build fine, so nothing fails — but it produces output from a different renderer, and (post-Cut PR build time: stop deleting the Hugo image cache, drop GOGC=3 #21060) it lands in a different cache namespace, so its cache work is written and never read by the others.
• A missed ensure.sh pin means every contributor's make ensure prints a version-mismatch warning until someone notices.

Suggested approach

Make mise.toml the single pin — it already exists to pin the toolchain, and vale, node, yarn, and golang live there too — then have the workflows and scripts/ensure.sh read from it rather than restate it.

Two wrinkles worth designing around rather than discovering:

1. The macOS pin isn't a bare semver. mise.toml:12 is extended_0.157.0 (the asdf plugin's format), so a single HUGO_VERSION value has to be composed into each consumer's expected shape, not substituted verbatim.
2. Don't interpolate into hugo-version: carelessly. If the expression resolves empty, peaceiris/actions-hugo installs latest — silently, and every workflow at once. That is strictly worse than the drift being fixed. Whatever reads the pin should fail loudly on an empty or unparseable value. Cut PR build time: stop deleting the Hugo image cache, drop GOGC=3 #21060's Resolve Hugo version for the cache key step is a worked example of that shape, including the sed -nE detail that makes the emptiness check actually fire.

Not urgent — nothing is broken today, and all 22 sites currently agree on 0.157.0. It's worth doing before the next Hugo upgrade rather than during one.