chore(deps): refresh Go dependencies and CI tooling

[steipete]

Refresh the Go dependency graph and CI tooling against the current published versions. Go 1.27.0 is now the minimum, with matching source-install documentation and pinned Go container images. Three mechanical errors.AsType changes satisfy the updated lint gate without changing error handling.

Updates are grouped as follows:

• Runtime modules: SQLite 1.56.0 → 1.57.0, libc 1.75.3 → 1.75.6, memory 1.12.0 → 1.12.1, x/crypto 0.54.0 → 0.55.0, x/ansi 0.11.7 → 0.11.8, go-runewidth 0.0.27 → 0.0.28, and terminfo from its 2022 pseudo-version to 1.0.0; tidy the module files.
• Analysis tools: golangci-lint 2.12.2 → 2.13.2, staticcheck 0.7.0 → 0.8.1, gosec 2.28.0 → 2.29.0, govulncheck 1.6.0 → 1.7.0, and deadcode/x/tools 0.48.0 → 0.49.0, kept consistent between Makefile and CI.
• CI/build dependencies: CodeQL Action 4.37.7 → 4.37.9, TruffleHog 3.97.0 → 3.97.1, Node 24 → 26 for docs, and refreshed Go/Dockerfile frontend image pins. Other Action and tool pins were checked and are current.

The optional Docker Git-source smoke previously required a semantic release version even though it installs a local source build. It now checks the existing devel contract, allowing the archive assertions to run. The Unreleased changelog records the maintenance update.

Held upgrades: Bubble Tea 2.0.9, Bubbles 2.2.1, and Lip Gloss 2.0.6 require a migration in Crawlkit, which owns the current v1 imports. Crawlkit 0.14.7 is current; this PR does not introduce a partial TUI migration. There are no open Dependabot or Renovate PRs superseded by this update.

Validation:

• make check passed: module verification/tidy, formatting, all analyzers, 11 test-bearing packages, 85.6% coverage against the 85% floor, race tests, CLI smoke, and six credential-free snapshot builds for macOS/Linux/Windows on amd64/arm64.
• actionlint and shellcheck scripts/docker-git-source-smoke.sh passed. Gitleaks scanned 487 commits and the working tree with no leaks.
• Docker build and CLI/Git smoke passed. scripts/docker-git-source-smoke.sh passed with a fresh one-message/one-embedding fixture, exercising import, search, messages, SQL, and report generation.
• Docs built successfully under Node 26.8.1.
• Codex autoreview completed with no findings at its configured P0-only threshold.
• Govulncheck found zero affected symbols or imported packages. It reports the unused x/crypto/openpgp advisory GO-2026-5932 at module level; no fixed version exists.

Baseline code CI, Docker, CodeQL, secret scanning, Pages, and scheduled maintenance workflows are green. The older manual release run failed only at the Homebrew handoff because TAP_TOKEN received HTTP 403 for openclaw/homebrew-tap; that credential/permission issue is outside this dependency PR. No release was run or modified.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): refresh Go dependencies and CI tooling This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.