update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• dependencies updated: 19
• gate green: precommit, check, vulncheck, osv-scanner, trivy (exit 0)
• notes: update Go to 1.26.5 and update 19 dependencies including bborbe/, sentry-go, prometheus/, golang.org/x/* packages

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

Based on my analysis:

Step 0: Worktree created at /tmp/pr-review-log-fix-update-go-693b083 with PR branch fix/update-go-693b083

Step 1: Mode is selector

Step 2: Go project (go.mod exists)

Step 3a: LICENSE file exists at repo root ✓

Step 3b: precommit skipped (selector mode)

Step 4a: Mechanical funnel already run — 0 findings

Step 4b-i: Candidate rules for changed files (CHANGELOG.md, go.mod, go.sum):

• adr/required-for-irreversible-architecture-decisions — trigger matches go.mod
• changelog/unreleased-entry-required — trigger matches CHANGELOG.md

Step 4c-sel CLASSIFY:

Rule	Decision	Reason
adr/required-for-irreversible-architecture-decisions	skipped	dependency updates are routine, not irreversible architecture
changelog/unreleased-entry-required	skipped	## Unreleased section exists and has a bullet

Applicable set = ∅, mechanical findings = ∅ → selector clean — no adjudication needed

Step 5: No issues found.

---

{
  "verdict": "approve",
  "summary": "PR updates Go to 1.26.5 and refreshes 19 dependencies in go.mod/go.sum. CHANGELOG has an Unreleased entry. LICENSE file present. No rule violations found in the diff — selector mode confirmed no applicable judgment rules and mechanical funnel found zero findings.",
  "comments": [],
  "concerns_addressed": [
    "security: go.mod dependency versions updated — rule-base mechanical scan confirmed 0 findings",
    "security: vuln scans (gate/vulncheck/osv-scanner/trivy) are CI's responsibility; no code changes in this diff",
    "correctness: Go 1.26.5 bump — no source files changed, no toolchain mismatch possible",
    "correctness: go.sum hashes updated — expected output of `go mod tidy` after dependency refresh"
  ]
}