Repo hygiene: dependabot backlog, Go CVE gate, PR #17

[gnanirahulnutakki]

Problem

Three hygiene blockers have accumulated:

1. Dependabot backlog — 13 open dependency-update PRs need triage; some may carry CVEs
2. Go CVE gate is inconclusive — the module declares go 1.26 but the local toolchain is go1.25, making govulncheck unable to run correctly
3. PR dev → main: v0.2.0 release promotion #17 is stale — dev → main v0.1.0, open since May 26, no decision made

Action

(a) Triage all 13 dependabot PRs: merge safe ones, close stale ones, flag any that carry CVEs
(b) Fix the go toolchain version mismatch so govulncheck runs clean in CI
(c) Make an explicit decision on PR #17 (merge, close, or convert to draft)

Acceptance criteria

• Dependabot backlog ≤ 3 open PRs (all triaged)
• govulncheck exits 0 in CI with no suppressed errors
• PR dev → main: v0.2.0 release promotion #17 is merged or closed

---

From the Ardur dual-track Master Plan (Track A). Verified locally 2026-06-23.

[gnanirahulnutakki]

Duplicate of #45 (created by an accidental orchestration double-spawn). Consolidating Track-A work on #45.