Repo hygiene: dependabot backlog, Go CVE gate, PR #17

[gnanirahulnutakki]

(a) Triage the 13-PR dependabot backlog.

(b) Go toolchain mismatch (module go1.26 vs local go1.25) makes govulncheck inconclusive — the Go CVE gate is currently blind; fix toolchain/CI so it runs.

(c) Decide PR #17 (dev->main v0.1.0, open since May 26) — cut the release or close.

Acceptance: dependabot triaged, govulncheck green in CI, PR #17 resolved.

Size: S

---

From the Ardur dual-track Master Plan (Track A). Verified locally 2026-06-23.