Delete tools.go and remove tool-dependency pollution from go.mod

[bborbe]

Removes tools.go so CLI tools are no longer Go module dependencies. Tool versions stay pinned via tools.env + go run pkg@\$(VERSION), which the Makefile already used.

Result

	before	after
go.mod	448 lines	26 lines
pollution grep	15 matches	0
go-git	v5.19.1 (2 CVEs)	gone entirely
replace directives	5	0

go-git was tool-only pollution — no source file in this repo imports a git library. Deleting tools.go removes it and both CVEs (GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j).

Commits

1. chore: bump go-git to v5.19.2 — unblocks the dark-factory preflight baseline, which was red on the very CVEs this PR removes.
2. Delete tools.go and remove tool-dependency pollution from go.mod — the migration (dark-factory).
3. fix: restore BSD license header on generated mocks — go generate rewrites mocks/mocks.go headerless; addlicense re-adds it as the last precommit step, so a failure before that step leaves it stripped.
4. fix: bump golang.org/x deps — removing the tool deps let go mod tidy fall back to minimal versions, surfacing 4 HIGH CVEs the tool deps had been masking.

Verification

• make precommit green (osv-scanner + trivy both clean)
• grep go-git go.mod → empty; pollution grep → empty; tools.go absent
• No application code changed — dependency hygiene only, zero behavior change

[ben-s-pull-request-reviewer]

PR Review: Delete tools.go and remove tool-dependency pollution from go.mod

Scope: dependency hygiene refactor — no application behavior changes

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

None.

---

Notes:

The migration is complete and correct. Key verifications performed:

Check	Result
go.mod line count	26 lines (was ~448) ✓
Direct deps in go.mod	4 genuine app deps only ✓
Tool deps removed	golangci-lint, osv-scanner, addlicense, etc. all gone ✓
Replace directives	All 5 removed ✓
go-git in go.mod	Not present ✓
go-git imports in source	Confirmed none — was tool-only transitive ✓
pkg/errors usage	Present in git-sync.go — correctly retained ✓
Pollution patterns	None found ✓
tools.env	Untouched, versions correctly pinned ✓
Makefile tools	Already using go run pkg@$(VERSION) with -mod=mod ✓
golang.org/x CVEs fixed	net v0.57.0, sync v0.22.0, sys v0.47.0, text v0.40.0 ✓
CHANGELOG.md	Unreleased entries added describing both changes ✓
Mechanical funnel	0 findings across 74 YAML rules ✓

Selector mode traceability: Classified all changed files — go.mod/go.sum changes are dependency hygiene (no rule triggers); tools.go deletion is structural (no rule triggers); CHANGELOG.md update is documentation (no rule triggers). No judgment rules triggered. Selector clean — no adjudication needed.

precommit skipped (selector mode) — CI covers lint+test

---

{
"verdict": "approve",
"summary": "Clean dependency hygiene refactor: tools.go deleted, go.mod shrunk from 448 to 26 lines, tool-only deps and 5 replace directives removed, go-git CVEs eliminated, golang.org/x bumped to clear 4 previously-masked HIGH CVEs. No source file imported go-git — confirmed it was exclusively a transitive tool dep. All tool versions remain properly pinned via tools.env and Makefile already invokes all tools via go run.",
"comments": [],
"concerns_addressed": [
"security: go-git removed — no source file imports it (confirmed via grep), GHSA-hc8v-wwc9-vgxm and GHSA-qgq7-7hm3-q39j eliminated",
"security: golang.org/x/{net,sync,sys,text} bumped to fix CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-56852",
"correctness: tools.go deleted, tools.env correctly unchanged, all tools still pinned",
"correctness: 5 replace directives removed, no dependency resolution issues",
"tests: precommit runs via CI (selector mode skipped), Makefile already uses go run for all tools"
]
}