build: pin toolchain and neutralize stale host GOROOT

.mise.toml

@@ -1,3 +1,11 @@
 [tools]
 go = "1.25.8"
 kind = "0.20.0"
+
+# Unset any GOROOT exported by the host shell so mise's managed Go toolchain is
+# always used, independent of the host's Go install. A host GOROOT pointing at a
+# different Go version than the pinned toolchain causes "compile: version
+# mismatch" errors. The Makefile also does `unexport GOROOT` for make-driven
+# builds that don't go through mise activation.
+[env]
+GOROOT = false

Makefile

@@ -19,6 +19,13 @@ CONTAINER_TOOL ?= docker
 SHELL = /usr/bin/env bash -o pipefail
 .SHELLFLAGS = -ec
 
+# A stale GOROOT inherited from the host shell (e.g. a Homebrew Go install
+# pointing at a different version than the `go` binary on PATH) causes
+# "compile: version X does not match go tool version Y". Strip it so every
+# recipe uses the go binary's own GOROOT. The toolchain version is pinned
+# reproducibly via .mise.toml and go.mod, independent of the host's Go.
+unexport GOROOT
+
 .PHONY: all
 all: build