chore(deps): refresh Go toolchain and dependencies

[steipete]

Refresh the Go dependencies and build tooling while keeping application code unchanged. The default branch's CI, Docker build, secret scan, and CodeQL workflows were green before this update.

Updates:

• Go 1.26.6 → 1.27.0, with the documented minimum and pinned Docker builder kept in sync; Alpine 3.23 → 3.24 and Dockerfile frontend 1.7 → 1.26.
• go-runewidth 0.0.27 → 0.0.28, testify 1.12.0 → 1.12.1, SQLite 1.56.0 → 1.57.0, libc 1.75.3 → 1.75.6, and memory 1.12.0 → 1.12.1. Testify now brings in go.yaml.in/yaml/v3 3.0.5 instead of gopkg.in/yaml.v3 3.0.1; go.sum is refreshed.
• CodeQL action 4.37.7 → 4.37.9 and TruffleHog 3.97.0 → 3.97.1, retaining exact commit pins; pre-commit-hooks 5.0.0 → 6.0.0.

All 40 go.mod requirements are current within their existing module paths. The remaining Actions and pinned govulncheck, deadcode, and sqlc tools are current. The shared release workflow retains its documented @v1 contract.

Held upgrades: Bubble Tea 1.3.10 → 2.0.9, Bubbles 1.0.0 → 2.2.1, and Lip Gloss 1.1.0 → 2.0.6 require the coordinated v2 migration in CrawlKit, which owns Slacrawl's TUI. Their import paths, view model, and input APIs change; forcing replacements here would be an incomplete upstream migration.

Proof:

• GOWORK=off make check passed: module verification/tidy, formatting, vet, govulncheck (no vulnerabilities), deadcode, 14 passing test packages (3 packages have no test files), and CLI help/version/metadata/init/status/TUI smoke checks.
• GoReleaser 2.18.0 snapshot produced all four macOS/Linux architecture archives and four Debian/RPM packages. No signing or publishing was performed.
• actionlint and git diff --check passed. All four upgraded pre-commit hooks and the Go test hook passed on changed files; the Go formatting hook had no changed Go files to check.
• A clean Docker build passed using a dedicated local builder. Container help, Git 2.54.0, Node 24.18.1, npm 11.12.1, and database init/status as the unprivileged image user passed.

Supersedes the dependency updates in #160 and #161. Those bot PRs are left open for maintainer follow-up. No release or merge is included.

Codex autoreview completed with no accepted/actionable findings at its default P0 threshold. PR CI also passed without retries: core CI, Docker, CodeQL, and secret scanning.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): refresh Go toolchain and dependencies This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.