fix(deps): bump golang.org/x/text to v0.39.0 (CVE-2026-56852)

[bborbe]

Fleet security update. golang.org/x/text v0.38.0 -> v0.39.0 (CVE-2026-56852). CHANGELOG under ## Unreleased; release agent versions on merge; no tag.

[ben-s-pull-request-reviewer]

Based on my analysis of the diff, I have sufficient information to render the verdict. The PR contains only dependency management files — no Go source code was modified.

{
  "verdict": "approve",
  "summary": "Clean CVE dependency bump: golang.org/x/text updated from v0.38.0 to v0.39.0 with consistent go.sum checksums. CHANGELOG properly documents the change under 'Unreleased'. No source code modifications — only dependency management files changed.",
  "comments": [],
  "concerns_addressed": [
    "security: CVE-2026-56852 patch applied — golang.org/x/text v0.39.0 in go.mod:416",
    "correctness: checksum update for v0.39.0 verified in go.sum:1118-1119"
  ]
}