chore: back-merge main → develop (adopt cobra 1.10.2 + reconcile drift)

[saadqbal]

Why (release prep)

develop is 11 commits ahead of main (the v0.9.3 payload), but main was 2 ahead of develop: the cobra 1.10.2 bump (#334) landed on main only (pre-#336, when Dependabot still targeted main), so develop was stuck on cobra 1.8.1. Promoting develop→main as-is would conflict on go.mod/go.sum and risk reverting cobra on main.

This back-merges main → develop so develop adopts cobra 1.10.2 before the promote — the durable drift fix (#336 already points future bumps at develop).

Resolution

• go.mod: union — kept the newer of each (progressbar v3.19.1 from develop chore(deps): bump github.com/schollz/progressbar/v3 from 3.19.0 to 3.19.1 #333, cobra v1.10.2 from main chore(deps): bump github.com/spf13/cobra from 1.8.1 to 1.10.2 #334).
• go.sum: regenerated via go mod tidy.
• Verified: go build ./... green, go vet clean, gofmt clean.

Merge this first; then the develop→main promote is clean.

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only change with no application code edits; cobra is the CLI framework and the bump is a minor version alignment already validated on main.

Overview
Back-merges the main-only cobra bump into develop so branch promotion does not fight over go.mod/go.sum or roll develop back to cobra 1.8.1.

The only functional change in the diff is bumping github.com/spf13/cobra from v1.8.1 to v1.10.2 in go.mod, with go.sum updated to match (including refreshed indirect entries such as go-md2man/v2). Other direct deps (e.g. progressbar v3.19.1) stay as on develop. No CLI or command-tree source files are modified in this PR.

^{Reviewed by Cursor Bugbot for commit 4fa3d8d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 38 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#183 — docs: SafeTensors deployment-order & resume-safety runbook (epic feat(auth): logout revokes the token server-side (cli#112) #116) · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#184 — test(weights): shared SafeTensors golden-corpus drift guard + declare safetensors dep (SEC-03) · author: @LukasWodka · no reviewer assigned
• averaging-service#185 — test(weights): average a real SafeTensors edge + a legacy edge in one cycle — SEC-03 §8 · author: @LukasWodka · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1119 — perf(api): cache ChoiceGroup + score-formula reference endpoints (#981 item 4, part 1) · author: @aptracebloc · reviewer: @saqlainsyed007
• backend#1122 — perf(api): cache the anonymous competition-template list (#981 item 4, part 2) · author: @aptracebloc · reviewer: @saqlainsyed007
• client#356 — main -> Stop prompting for location during registration, auto-derive from timezone · author: @saadqbal · no reviewer assigned
• data-ingestors#361 — feat(ingest): emit per-column feature_stats for combine-time normalization (Redesign tb resources: two-line view (secure environment + per-run allocation) #360) · author: @divyasinghds · no reviewer assigned
• data-ingestors#372 — fix(validators): use redaction.column_preview for mask_id error column lists · author: @divyasinghds · no reviewer assigned
• design-system#63 — fix(Input): inline icon SVGs so the published bundle renders them (fix(install.sh): persist PATH to the shell rc (parity with install.ps1) #61) · author: @LukasWodka · reviewer: @waqaskhanroghani

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)