spec-0m2 Bump gqlparser/gqlgen in specs past the GO-2024-2920 floor and fix broken codegen Lined Up

What is wrong: `sourcehut-specs/go.mod` pins `github.com/vektah/gqlparser/v2 v2.5.8` + `github.com/99designs/gqlgen v0.17.36`, and `sourcehut-specs/graph/generate.go`'s `go:generate` directive is unpinned (`go run github.com/99designs/gqlgen generate`). Two failure modes on one pin: gqlparser v2.5.8 is below the GO-2024-2920 floor (a DoS in `parseDirectives`, fixed in v2.5.14); and gqlgen v0.17.36 itself pins `golang.org/x/tools v0.9.3`, which does not compile under this toolchain, so `go generate ./graph` in specs is broken outright — specs' own comment records the cause.

Why it matters: specs' `/query` parses only after `graph/server.go::resolveCaller`/`::gate`, so this is not the fully unauthenticated shape the advisory describes — that's the mitigation. But codegen being broken means specs cannot regenerate its own GraphQL resolvers when the schema changes.

Sibling that does it correctly: `sourcehut-artifacts`, `sourcehut-bench`, `sourcehut-coverage`, `sourcehut-curator`, `sourcehut-dolt` (and `thistle`, `sr-ht-api`, `sourcehut-federation`) are all on `gqlparser v2.5.36` + `gqlgen v0.17.94`.

Fix: bump `sr-ht-core` and `sr-ht-ecore` first (they are libraries and set the floor for every consumer, tracked as separate issues in those repos), then in specs: `go get github.com/vektah/gqlparser/v2@v2.5.36 github.com/99designs/gqlgen@v0.17.94`; pin the `go:generate` line in `graph/generate.go` to `@v0.17.94` like the other five services.

Note: confidence verified — go.mod version strings were read directly across all nine services plus core/ecore, split exactly 5/5.

Audit: D06 (cross-repo audit, 2026-08-17)