fix(deps): bump golang.org/x/text to v0.39.0 (CVE-2026-56852)

[bborbe]

Fleet security update via github-update-go agent. Bumps golang.org/x/text v0.38.0 -> v0.39.0 (CVE-2026-56852, infinite loop on invalid input). CHANGELOG under ## Unreleased; release agent versions on merge; no tag.

[ben-s-pull-request-reviewer]

The changed files are CHANGELOG.md, go.mod, and go.sum — no Go source files. The diff touches no ast-grep rule triggers.

Step 4 early exit: No changed file matches any rule glob pattern. Step 4 skipped.

Step 3a: LICENSE file exists at repo root.

Step 5 — Consolidated Report

{
  "verdict": "approve",
  "summary": "Clean dependency security bump: golang.org/x/text updated to v0.39.0 resolving CVE-2026-56852, go.sum checksums correct, CHANGELOG entry under ## Unreleased is present and properly describes the CVE fix.",
  "comments": [],
  "concerns_addressed": [
    "security: golang.org/x/text v0.39.0 in go.mod:40 — correctly bumped from prior version to resolve CVE-2026-56852",
    "correctness: go.sum entries for golang.org/x/text v0.39.0 present with h1 checksum and go.mod hash",
    "correctness: CHANGELOG.md:13 — ## Unreleased bullet correctly describes the CVE fix"
  ]
}