ci: prevent stale generated artifacts after tool upgrades

[loveRhythm1990]

Summary

• always regenerate zz_generated.deepcopy.go from the phony generate target instead of relying on file mtimes
• validate repository-local controller-gen and crd-ref-docs binaries against their pinned module versions and reinstall mismatches
• keep tool paths anchored to api/bin for all supported Make invocation styles
• add a focused local verify-generated target that checks DeepCopy, CRDs, webhook manifests, and API reference output
• serialize the local generated-artifact verification steps even when Make is invoked with -j

The existing required checks job continues to run make verify; because DeepCopy generation is now unconditional, its full-worktree cleanliness check can no longer be bypassed by stale file mtimes.

Testing

• make ci-reviewable
• make check-license
• make -j8 verify-generated
• verified that a temporary stale artifact makes verify-generated fail
• verified pinned versions through Go binary build metadata
• verified environment variables do not override the pinned versions
• git diff --check

Refs #603

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request