Automate the per-release go.mod k8s version bump (gen-compdocs, genref)

The Kubernetes staging module pins in `gen-compdocs/go.mod` (in the `replace` block) and `genref/go.mod` (direct `require`s) are **hand-edited every release**. Tedious and error-prone. Dependabot only covers `npm`/`bundler` and can't do this anyway: the staging set must move together in one coordinated bump, not one PR per module.

## Proposed changes

- Move `set_version_dirs.sh` → `hack/` (alongside `gen-enum-swagger.sh`, `verify-enum-swagger.sh`); update the `createversiondirs` Makefile path.
- Add `hack/update-go-mod.sh` + `make update-mod`: given `K8S_RELEASE`, bump the coordinated k8s set in `gen-compdocs` and `genref`, then `go mod tidy`.

```shell
export K8S_RELEASE=1.37.0
make update-mod
```

**What it bumps:** every `k8s.io/*` pinned to a concrete `v0..` (in `require` *or* `replace`) → `v0..0`, plus `k8s.io/kubernetes` (where required) → `v1..0`. **What it leaves alone:** pseudo-versions (`gengo`, `kube-openapi`, `utils`) and independently-versioned modules (`klog/v2`, `system-validators`).

## Depends on
https://github.com/kubernetes-sigs/reference-docs/issues/462: `k8s.io/kubernetes` must be a versioned `require` (not the local-path replace) for the main-module bump to apply.

## Test (locally)

- **Selection** — bumped to 1.35 and diffed: every staging `replace`/`require` and `k8s.io/kubernetes` moved; `klog`/`gengo`/`kube-openapi`/`utils` untouched.
- **End-to-end** — run at 1.36 (current): both repos processed, `go mod tidy` clean, idempotent no-op.