ci: single-source the Hugo version (.hugoversion) + auto-bump (closes #15)

[VijitSingh97]

Resolves #15. HUGO_VERSION was hardcoded independently in ci.yml (0.162.1) and deploy.yml (0.162.1) — they could silently drift, so CI could validate with a different Hugo than production deploys.

What this does

• .hugoversion — one file, just the version string. The single source of truth.
• ci.yml + deploy.yml read it in-step (HUGO_VERSION="$(cat .hugoversion)") instead of a literal env, so drift is impossible by construction. deploy.yml's build job is reordered to checkout before installing Hugo (the file has to exist first). Reading locally in the run block — not via $GITHUB_ENV — keeps it clear of the github-env injection class (zizmor stays clean).
• hugo-bump.yml — a weekly scheduled job (+ workflow_dispatch) that checks gohugoio/hugo for a newer release and opens a PR editing .hugoversion (Dependabot can't track a wget'd .deb). Manual bump = just edit the file.
• README documents .hugoversion as the single source.

Acceptance (#15)

• Hugo version defined in exactly one place; both workflows read it
• Drift impossible by construction (no second literal to forget)
• Documented path (auto-PR and manual) keeps Hugo current

Verified

• prettier/markdownlint clean, all workflow YAML valid, cat .hugoversion → 0.162.1
• zizmor .github/workflows/ → no findings (incl. the new bump workflow)
• The strict-build job in this PR exercises the new file-read path end-to-end.

Note: the bump PR is opened with the built-in GITHUB_TOKEN, which doesn't auto-trigger CI on the PR it creates — re-run CI on a bump PR before merging. Documented in the workflow header.

🤖 Generated with Claude Code