ci: sync the README Caddy floor with go.mod automatically

.github/workflows/readme-sync.yml

@@ -0,0 +1,45 @@
+name: Sync README Caddy floor
+
+permissions:
+    contents: write
+
+on:
+    pull_request:
+        paths:
+            - go.mod
+
+concurrency:
+    group: readme-sync-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+jobs:
+    sync:
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        runs-on: ubuntu-latest
+        timeout-minutes: 5
+
+        steps:
+            - uses: actions/checkout@v6
+              with:
+                  ref: ${{ github.head_ref }}
+            - name: Update the README floor to match go.mod
+              run: |
+                  CADDY=$(awk '$1 == "github.com/caddyserver/caddy/v2" {print $2}
+                               $1 == "require" && $2 == "github.com/caddyserver/caddy/v2" {print $3}' go.mod)
+                  # Strict format check: blocks sed injection and skips
+                  # pseudo-versions, which do not belong in the README.
+                  if ! echo "$CADDY" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+                      echo "no clean Caddy release version in go.mod (got '$CADDY'), skipping" >&2
+                      exit 0
+                  fi
+                  sed -i -E "s|Requires Caddy v[0-9]+\.[0-9]+\.[0-9]+ or newer|Requires Caddy ${CADDY} or newer|" README.md
+            - name: Commit and push if changed
+              run: |
+                  if git diff --quiet README.md; then
+                      echo "README already matches go.mod"
+                      exit 0
+                  fi
+                  git config user.name "github-actions[bot]"
+                  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+                  git commit -am "docs: sync README Caddy floor with go.mod"
+                  git push