chore(deps): automated bump for main

[ericfitz-deps-bot]

Automated dependency bump for main (safe patch/minor only).

Generated by the deps:bump skill running headless in CI. Review before merging.

Skill output / manual-review plan

Commit created. Per CI instructions, stopping here — push and PR are handled by a separate CI step.

---

### Phase 11: Manual Review Plan

**Priority 1 — Go Standard Library Vulnerabilities (require toolchain upgrade)**

6 vulnerabilities in the standard library fixed in Go 1.26.3 / 1.26.4. These **cannot** be addressed by module dependency updates — the Go toolchain itself must be upgraded in CI and in `go.mod`.

| ID | Package | Fixed in | Description |
|----|---------|----------|-------------|
| GO-2026-5039 | net/textproto | go1.26.4 | Arbitrary inputs in errors without escaping |
| GO-2026-5037 | crypto/x509 | go1.26.4 | Inefficient candidate hostname parsing |
| GO-2026-4986 | net/mail | go1.26.3 | Quadratic string concatenation in consumeComment |
| GO-2026-4977 | net/mail | go1.26.3 | Quadratic string concatenation in consumePhrase |
| GO-2026-4971 | net | go1.26.3 | Panic on NUL byte in Dial/LookupPort (Windows only) |
| GO-2026-4918 | net/http | go1.26.3 | Infinite loop in HTTP/2 transport |

**Recommendation:** Update the CI workflow Go version from `1.26.2` to `1.26.4`, and update `go 1.26.2` in `go.mod` to `go 1.26.4`. This is a patch upgrade within the same minor series and should be low-risk.

---

**Priority 2 — Many transitive Go packages not in go.mod (55 packages)**

These packages showed as outdated in `go list -m -u all` but are not explicitly listed in `go.mod`. They are resolved by Go's MVS algorithm from the direct dependencies we've already updated. No action needed — running `go mod tidy` (which already ran) is sufficient.

Examples of what's being managed transitively: `github.com/Azure/azure-sdk-for-go/*`, `cloud.google.com/go/compute/metadata`, `github.com/klauspost/compress`, `golang.org/x/tools`, etc.

---

**Summary:**

| Category | Count | Status |
|----------|-------|--------|
| Go modules updated | 13 | ✓ Applied |
| Node security fix (dompurify) | 1 | ✓ Applied |
| Node package updated (@redocly/cli) | 1 | ✓ Applied |
| Excluded (golang/protobuf) | 1 | Skipped per CLAUDE.md |
| Needs plan (Go stdlib vulns) | 6 | See Priority 1 above |

**Build:** PASSED | **Tests:** PASSED | **Lint:** PASSED (0 issues)