chore(deps): refresh Go dependencies and CI tooling

[steipete]

What changed

Refresh the Go dependency stack and CI security tooling while keeping the library and CLI implementation unchanged. This raises the minimum Go version to 1.27.0; the README and Unreleased changelog now reflect that requirement.

Group	Updates
Go	1.26.6 → 1.27.0
SQLite	modernc.org/sqlite 1.56.0 → 1.57.0; libc 1.75.3 → 1.75.6; memory 1.12.0 → 1.12.1
Terminal support	go-runewidth 0.0.27 → 0.0.28; xo/terminfo 2022 pseudo-version → 1.0.0
Go support libraries	x/crypto 0.54.0 → 0.55.0; x/text 0.40.0 → 0.41.0
Local and CI analysis	deadcode 0.48.0 → 0.49.0; govulncheck 1.6.0 → 1.7.0
Actions	CodeQL 4.37.7 → 4.37.9; TruffleHog 3.97.0 → 3.97.1, both pinned to verified release commits

Checkout, Setup Go, Create GitHub App Token, and Stale already use current release commits. The shared release workflow remains on its existing v1 channel. Go dependencies were refreshed with GOWORK=off go get -u -t ./... and tidied; dependencies used only by upstream modules' own tests/tools were not added as new direct pins.

Held upgrades

• Bubble Tea 1.3.10 → 2.0.9: new charm.land imports plus incompatible view, keyboard, mouse, and terminal-option APIs require a coordinated TUI migration.
• Bubbles 1.0.0 → 2.2.1: the new major uses the Bubble Tea v2 ecosystem and requires the same migration.
• Lip Gloss 1.1.0 → 2.0.6: hold the new import/type contracts with the existing v1 TUI stack rather than ship a partial migration.

See the upstream Bubble Tea migration guide. No open Dependabot or Renovate PRs are superseded. The unrelated Unreleased-section automation PR #91 is unchanged; its changelog insertion will overlap this PR.

Proof

• make check: module tidiness, formatting, vet, deadcode, govulncheck, unit tests and race tests passed; all 17 packages passed in both test modes.
• GOWORK=off go test -count=1 -json ./...: 373 passing tests, 2 expected skips, 0 failures across 17 packages. Skips are the Windows-only URI case on macOS and the opt-in real-Python TurboVec integration.
• Govulncheck: 0 reachable vulnerabilities and 0 vulnerabilities in imported packages; 1 module-level advisory outside the code's call paths.
• make build; built crawlctl --help and crawlctl --version: passed with a temporary home/config/cache/data environment.
• actionlint 1.7.12, GOWORK=off go mod verify, and git diff --check: passed.
• Isolated Codex autoreview: passed with no actionable findings at the installed helper's default P0 threshold. The bundled helper initially rejected the workflow filename; the installed helper's explicit workflow handling and mandatory TruffleHog scan accepted the full bundle.

Local proof ran on macOS arm64 with Go 1.27.0. Linux and Windows execution remains covered by PR CI. Build output was removed after validation.

Baseline CI and scope

Default-branch CI, CodeQL, and secret scanning were green before this change. Stale, ClawSweeper Dispatch, and the last Crabbox Hydrate run were also green.

The latest Release (unified) run failed at publication because the existing public release's checksums.txt bytes differed from the verified attestation. That safeguard needs release-owner reconciliation, not a dependency change. This PR does not alter or rerun release publication and creates no release or tag.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): refresh Go dependencies and CI tooling This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.