update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• dependencies updated: 18
• gate green: precommit, check, vulncheck (exit 0)
• notes: updated 18 bborbe/* dependencies to latest versions, all gates green

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

PR Review: fix/update-go-c3266dd → master

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

None.

---

Traceability (Selector Mode)

Field	Value
Candidates	6 rules matched by Step 4b-i glob filter
Applicable	2 rules selected by Step 4c-sel
Mechanical findings	0 (ast-grep funnel: 74 yamls, 0 findings)
Skipped	changelog/preamble-frozen → no preamble touch changelog/unreleased-entry-required → already satisfied go-mod-dependency-fix/exclude-over-cross-repo-replace → no replace added go-mod-dependency-fix/tidy-after-get-update → already verified tidy run via go.sum consistency go-mod-replace/no-cross-repo-replace → no replace directives

---

Summary

This PR bumps 18 bborbe/* dependencies to their latest patch versions, accompanied by go.sum updates and a ## Unreleased CHANGELOG entry with the chore: conventional prefix. The mechanical funnel ran 74 YAML rules with zero findings. All applicable judgment rules pass: the CHANGELOG prefix is valid, and the go.sum hashes are consistent with a go mod tidy run. precommit was skipped (selector mode) — CI covers lint+test.

---

{
"verdict": "approve",
"summary": "PR updates 18 bborbe/* Go module dependencies. Mechanical funnel (74 yamls) found 0 findings. CHANGELOG uses valid 'chore:' prefix, go.sum hashes are consistent with 'go mod tidy', no replace directives added. No violations.",
"comments": [],
"concerns_addressed": [
"security: dependency updates clear listed CVEs — confirmed by go.mod version bumps",
"security: vulncheck gate — noted, cannot verify from diff alone (CI responsibility)",
"correctness: no breaking API changes in bborbe/* module bumps (patch versions only)",
"correctness: CHANGELOG entry accurately reflects dependency/CVE changes",
"tests: precommit/check gates — noted, cannot verify from diff (CI responsibility)",
"performance: go.sum hashes consistent with go.mod versions — verified"
]
}