Summary

Removes a hardcoded Go version literal in codegen/update.sh that could silently drift out of sync with codegen/Dockerfile. No functional/behavioral changes when versions already match, this only changes how the version is sourced.

Problem

Three places currently encode a Go version, independently of each other:

• go.mod: go 1.20
• codegen/Dockerfile: ARG GO_VERSION=1.20.5
• codegen/update.sh: hardcoded golang:1.20 for the go mod tidy step
  They agree today, but nothing ties them together. Bumping the Dockerfile's GO_VERSION (e.g. for a Go security patch or minor upgrade) doesn't touch update.sh, so the go mod tidy step could end up running against a different Go version than the one CI actually builds/tests with, a subtle, easy-to-miss source of drift.

Change

codegen/update.sh now reads GO_VERSION directly out of codegen/Dockerfile:

GO_VERSION="$(sed -n 's/^ARG GO_VERSION=//p' codegen/Dockerfile)"

and uses it for the go mod tidy container instead of the hardcoded golang:1.20 tag. A guard checks the value was actually found and fails loudly (instead of silently running go mod tidy under a stale/wrong image) if the Dockerfile's ARG line is ever renamed or removed.