fix(action): default the binary version to the pinned action ref

[laurigates]

Closes #169.

inputs.version defaulted to latest, so a workflow pinned to a commit SHA still installed whatever the newest release happened to be at run time. A release could then change a surf check verdict on a repo whose workflow file and hubs had not changed.

The default now resolves to the workspace version bundled at the action ref, so a pinned uses: pins the binary as well — the version half of what #118 did for the installer script. An explicit version: still wins, and version: latest keeps the floating behaviour.

Two notes on the approach:

• Cargo.toml instead of a VERSION file. The issue suggested writing the tag to a VERSION file at release prep. I read Cargo.toml instead, since CONTRIBUTING already calls it the single source for the released version and a second file can drift from it silently. scripts/workspace-version.sh now holds that one parser, and scripts/bump-docs-version.sh — which was already parsing Cargo.toml — calls it rather than duplicating the awk.
• Resolution fails closed. If the bundled version can't be read, the step errors and points at the version: input. Falling back to latest there would quietly reintroduce the floating install this default exists to prevent.

Happy to switch to the VERSION file if you'd rather keep the release metadata out of the action path.

Verification

Gates, on this branch:

cargo fmt --all --check                                     # clean
cargo clippy --all-targets --all-features -- -D warnings    # clean
cargo test --all                                            # 252 passed, 0 failed
cargo run -q -p surf-cli -- lint                            # 0 errors (20 pre-existing warnings)
cargo run -q -p surf-cli -- check                           # all anchored spans match their stored hashes

End to end on a runner — scratch workflow on my fork consuming this branch as uses: ./ (run, all four jobs green):

version input	installer log
unset (default)	surf: downloading v0.8.0 (x86_64-unknown-linux-gnu) → surf 0.8.0
v0.7.0	surf: downloading v0.7.0 (x86_64-unknown-linux-gnu) → surf 0.7.0
latest	resolves the newest release → surf 0.8.0
unset, running the real gate	surf check: all anchored spans match their stored hashes.

And the fail-closed path, with the version script absent from the action path:

surf: could not read the bundled version at this action ref
surf: set the action's `version:` input explicitly (e.g. version: v0.8.0)

One thing to expect: ci.yml's pull_request paths filter doesn't cover action.yml, scripts/, docs/ or CHANGELOG.md, so no CI run will attach to this PR. The gate output above is from running them locally.

🤖 Generated with Claude Code