The standalone workflow has failed weekly since its token secret went missing. One bot, one credential, one pull request to review.
The oapi-codegen pin stays the single source of truth: the generate area reads it back out of the Makefile, so the clients are regenerated with whatever this lands on.