deps: tidy the example module and let Dependabot see it

[scrothers]

What & why

CI on main is currently red. This fixes it, and fixes the reason it happened.

examples/provider is a separate Go module — deliberately, since it exists to prove pkg/ builds from outside the main one (#14). The github-actions bump in #13 also moved the root go.mod, but a nested module has its own pins, so it was left behind. The CI step added in #14 runs go mod tidy there and fails on any diff, which is exactly what it did:

FAILED JOB: Build & vet
  → Build the standalone example provider

Two changes:

1. Tidy examples/provider — fixes today. The versions are Dependabot's from ci: bump the github-actions group across 1 directory with 4 updates #13, not chosen here; go mod tidy resolves them from the root module's graph.
2. Add /examples/provider to Dependabot's gomod entry — fixes the cause. Dependabot resolves a directory, not a repository, and that entry only listed /. Without this, the nested module goes stale silently on every root bump and every future dependency PR turns main red the same way.

This is the same failure mode the config's own composite-action note already warns about, one entry below:

"/" covers .github/workflows. Composite actions are not picked up by it — each one's directory has to be listed, or the SHAs pinned inside it go stale silently while the workflows around it stay current.

Checklist

• Local gate passes: go mod tidy is a no-op, go build ./..., go vet ./..., gofmt -l -s . prints nothing, go test -race -covermode=atomic ./..., golangci-lint run
• Observable behavior changes update the matching docs/specifications/ document in this same PR (no spec-visible behavior changes — dependency pins and CI config only)
• No hand edits under pkg/*/proto/v1/ — .proto changes made in api/ and regenerated with buf generate (no proto changes)
• Doc cross-references are path + heading anchor (never section numbers); renamed headings were grepped for inbound anchors (no doc changes)
• New internal/ packages include README.md + CLAUDE.md in the same commit (no new packages)
• No compiled artifacts outside bin/

Also verified: the failing CI step reproduced locally verbatim (go mod tidy && git diff --exit-code && go build && go vet && go test inside examples/provider) and now passes, and .github/dependabot.yml still parses with the gomod entry resolving to ['/', '/examples/provider'].

Notes for reviewers

Worth a look at whether any other nested module could appear later and hit this again — right now examples/provider is the only one, and the added comment says why each module needs its own entry rather than just listing this one.

The bump itself is untouched: I did not choose or pin any version here, only let tidy propagate what #13 already landed at the root.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

examples/provider/go.mod

Package	Version	License	Issue Type
golang.org/x/net	0.57.0	Null	Unknown License
golang.org/x/sys	0.47.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
gomod/golang.org/x/net	0.57.0	Unknown	Unknown
gomod/golang.org/x/sys	0.47.0	Unknown	Unknown
gomod/google.golang.org/genproto/googleapis/rpc	0.0.0-20260720211330-0afa2a65878a	🟢 7.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 SAST 🟢 3 SAST tool is not run on all commits -- score normalized to 3

Scanned Files

• examples/provider/go.mod

[Copilot]

Pull request overview

Fixes CI failures caused by a stale nested Go module in examples/provider by aligning its dependency graph with the root module and ensuring Dependabot keeps it updated going forward.

Changes:

• Ran go mod tidy for the standalone examples/provider module, updating its indirect dependency versions and checksums.
• Updated .github/dependabot.yml to include /examples/provider in the Go module update scope (via directories) so future root bumps don’t leave the nested module behind.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
examples/provider/go.mod	Updates indirect dependency versions after tidying the nested module.
examples/provider/go.sum	Refreshes module checksums consistent with the updated go.mod.
.github/dependabot.yml	Adds /examples/provider to Dependabot’s Go module directories to prevent future drift/CI breakage.