Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@examples/workflows/collision-resolution/go.mod`:
- Line 3: Update the go directive in the module file to remove the
patch/toolchain patch version: replace the current `go` directive value `1.25.8`
with the language version `1.25` (i.e., change the `go` directive in the go.mod
to `go 1.25`) so the file uses the proper Go language version syntax rather than
a patched toolchain number; if you need to pin a specific toolchain, use a
separate `toolchain` directive instead.

In `@generator/compile_test.go`:
- Around line 90-96: Multiple test helpers create duplicate inline go.mod
content via the goModContent variable; centralize this into a single constant or
helper to prevent version drift. Replace repeated inline goModContent usages
with a shared constant (e.g., testGoModTemplate) or a helper function (e.g.,
WriteTestGoMod(outputDir, goVersion)) and update callers that currently set
goModContent and call os.WriteFile to use that helper/constant instead (refer to
the goModContent occurrences in compile_test.go). Ensure the helper writes the
same file permissions and retains the go version placeholder so version bumps
happen in one place.

In `@Makefile`:
- Around line 12-15: Add a Makefile preflight that fails fast when the
configured Go toolchain is missing or older than 1.25: in the block that
currently uses GO_SDK and QUALITY_TARGETS, add a check (using GO_SDK or `go
version` when GO_SDK is unset) to parse the Go major.minor version and abort
with a clear error if it is less than 1.25 (or if GO_SDK path like
$(HOME)/sdk/go1.25.8 is missing), so running the QUALITY_TARGETS (e.g.
check/lint/test) cannot proceed on an unsupported Go version; reference the
existing GO_SDK and QUALITY_TARGETS symbols when implementing the check so it
gates the same targets.

---

Outside diff comments:
In @.github/workflows/release.yml:
- Around line 8-10: Top-level workflow permissions are too permissive: change
the top-level permissions entry from contents: write to contents: read, and if
any job or step truly needs write, grant contents: write only on that specific
job/step; reference the top-level permissions block and the steps using
actions/checkout@v6 and goreleaser-action (which should rely on
secrets.HOMEBREW_TAP_TOKEN) to scope the write permission down to where the
custom PAT is used.

In `@internal/doctest/doc_api_sync_test.go`:
- Around line 231-266: The variable name used for the file name (assigned as
name in the entries loop and used in ParseFile/error messages) is shadowed by
the inner loop variable "name" in the ValueSpec loop; rename the inner loop
variable (e.g., to ident or valName) in the for _, name := range s.Names loop so
it no longer shadows the file-level name, keeping references to the file name
(ParseFile and require.NoError message) unchanged; update any usages inside that
inner loop to use the new identifier (e.g., ident.Name) instead.