security: bump go-git/v5 to v5.19.2

[stevenolen]

Summary

Bumps github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2 to remediate a high-severity directory traversal vulnerability flagged by dependency scanning. go-git is an indirect dependency (pulled in via the Pulumi automation SDK).

Details

• Remediates CVE-2026-71557 / CVE-2026-71556 (path traversal / symlink following in go-git's filesystem storage engine), fixed upstream in v5.19.2.
• Applied in both the lib and cmd modules (cmd consumes lib via a local replace, so its lockfiles were re-tidied to match).
• v5.19.2 raises the minimum versions of several golang.org/x/* modules (crypto, net, sys, term, text, tools, mod); go mod tidy applied those.

Verification

• go build ./... clean; format, lint, and lib/cmd tests pass via pre-commit hooks.

[claude]

Claude finished @stevenolen's task in 37s —— View job

---

PR Review

• Read review guidelines
• Examine diff for correctness
• Post review feedback

---

LGTM. The diff is exactly what go mod tidy produces after bumping go-git/v5 to v5.19.2 in both lib and cmd modules. A few observations:

What was checked:

• Both lib/go.mod and cmd/go.mod correctly update go-git/v5 from v5.19.1 → v5.19.2 (indirect)
• The golang.org/x/* version bumps (crypto, mod, net, sys, term, text, tools) are consistent across both modules and match each other — this is the expected cascading effect from go mod tidy after updating the transitive dependency
• golang.org/x/sync remains at v0.21.0 in both modules, which is correct — go-git v5.19.2 doesn't require a higher minimum for it
• go.sum hash replacements are symmetric (old hash removed, new hash added) for all updated modules in both modules

No concerns — this is a clean, minimal security patch with no source code changes, no new dependencies, and no unexpected version movements.