zola and pagefind are run ad-hoc for now (pagefind via npx, zola from a downloaded release binary in ci). toolchain versions aren't pinned yet.
nix is planned to pin exact zola/pagefind versions for both local dev and ci, so the "curl latest zola release" step in ci stops being a moving target — not set up yet.