Delete tools.go and remove tool-dependency pollution from go.mod

[bborbe]

Removes tools.go so CLI tools are no longer Go module dependencies. Tool versions stay pinned via tools.env + go run pkg@\$(VERSION), which the Makefile already used.

Third and last repo in this sweep, after git-rest and git-sync.

Result

	before	after
go.mod	443 lines	49 lines
pollution grep	15 matches	0
go-git	present (tool-only)	gone entirely
replace directives	5	0
exclude directives	1	0

Removing the replace and exclude blocks also fixes a standing violation of this repo's own docs/dod.md: "No exclude or replace directives in go.mod (break remote install)".

go-git was tool-only pollution — no source file here imports a git library — so removing it means future go-git advisories never apply to this repo at all.

Commits

1. chore: bump go-git, grpc and golang.org/x deps — unblocks the dark-factory preflight baseline, which was red on go-git and grpc CVEs.
2. Delete tools.go and remove tool-dependency pollution from go.mod — the migration (dark-factory).

Two guards carried over from the sibling git-sync migration

• golang.org/x/* bumped explicitly. Removing the tool deps drops the version floor they imposed, so go mod tidy slides transitive deps backwards to CVE-carrying minimums. On git-sync this dropped x/net v0.56.0 → v0.53.0 and trivy failed with 4 HIGH CVEs.
• mocks/mocks.go license header verified. go generate rewrites it headerless and addlicense re-adds it as the last precommit step, so an earlier failure leaves it stripped — which is exactly what happened on git-sync.

Verification

• make precommit green (osv-scanner + trivy both clean)
• pollution grep, go-git grep, and ^(replace|exclude) grep all empty; tools.go absent
• all 5 //go:generate directives pinned to counterfeiter/v6@v6.12.2, matching tools.env
• No application logic changed — only the 5 //go:generate comment lines plus dependency metadata

[ben-s-pull-request-reviewer]

All matches are //go:generate comments, not actual imports. The application code is clean.

Let me now compile the final report:

Review Summary:

• tools.go deleted: ✅ Confirmed
• No replace/exclude directives: ✅ Confirmed absent from go.mod
• No tool pollution: ✅ No golangci-lint, osv-scanner, or other tool packages in go.mod
• go-git gone: ✅ Confirmed absent
• golang.org/x/ bumped*: ✅ x/net v0.57.0, x/sync v0.22.0, x/text v0.40.0
• //go:generate updated: ✅ All 5 suite files updated to @v6.12.2
• mocks/mocks.go license header: ✅ // Copyright (c) 2026 Benjamin Borbe
• No tool imports in app code: ✅ Only //go:generate comments, no actual imports
• CHANGELOG.md: ✅ Properly updated with Unreleased section
• Mechanical findings (5x no-testing-t-direct): FALSE POSITIVES — All 5 are the exempt Ginkgo suite bootstrap pattern (RegisterFailHandler(Fail); RunSpecs(t, ...))

{
  "verdict": "approve",
  "summary": "PR cleanly deletes tools.go and removes all tool-only dependencies from go.mod. Replace/exclude directives are gone, golang.org/x/* deps are bumped to latest, go:generate directives are pinned to counterfeiter/v6@v6.12.2, and mocks/mocks.go retains its license header. The 5 ast-grep MUST findings for no-testing-t-direct are false positives — each is the exempt Ginkgo suite entry-point pattern (RegisterFailHandler + RunSpecs). No issues found.",
  "comments": [
    {
      "file": "pkg/pkg_suite_test.go",
      "line": 16,
      "severity": "nit",
      "message": "go-testing/no-testing-t-direct mechanical finding is a FALSE POSITIVE: func TestSuite is the exempt Ginkgo suite entry-point (RegisterFailHandler(Fail); RunSpecs), not a stdlib-style test requiring porting to Ginkgo DSL."
    },
    {
      "file": "pkg/watcher/suite_test.go",
      "line": 16,
      "severity": "nit",
      "message": "go-testing/no-testing-t-direct mechanical finding is a FALSE POSITIVE: func TestWatcher is the exempt Ginkgo suite entry-point."
    },
    {
      "file": "pkg/notify/suite_test.go",
      "line": 16,
      "severity": "nit",
      "message": "go-testing/no-testing-t-direct mechanical finding is a FALSE POSITIVE: func TestNotify is the exempt Ginkgo suite entry-point."
    },
    {
      "file": "pkg/config/suite_test.go",
      "line": 16,
      "severity": "nit",
      "message": "go-testing/no-testing-t-direct mechanical finding is a FALSE POSITIVE: func TestConfig is the exempt Ginkgo suite entry-point."
    },
    {
      "file": "pkg/cli/suite_test.go",
      "line": 16,
      "severity": "nit",
      "message": "go-testing/no-testing-t-direct mechanical finding is a FALSE POSITIVE: func TestCli is the exempt Ginkgo suite entry-point."
    }
  ],
  "concerns_addressed": [
    "correctness: tools.go deleted — no application imports of tool-only packages found",
    "correctness: 5 replace directives and exclude directive removed — verified clean in go.mod",
    "correctness: suite_test.go files updated with //go:generate go run github.com/maxbrunsfeld/counterfeiter/v6@v6.12.2 — all 5 files, diff confirms",
    "correctness: mocks/mocks.go license header intact — Copyright (c) 2026 confirmed",
    "security: golang.org/x/* deps bumped to latest (x/net v0.57.0, x/sync v0.22.0, x/text v0.40.0)",
    "tests: suite test infrastructure unchanged — only license year and generate directive updated"
  ]
}