chore(deps): refresh Go and CI tooling

[steipete]

Summary

• refresh stable Go modules: go-toml 2.4.2, modernc.org/sqlite 1.53.0, and modernc.org/libc 1.73.5
• refresh CI/release tooling and GitHub Actions to current stable releases
• apply the formatting required by gofumpt 0.10.0 and align local/release documentation
• record the maintenance work in the 0.11.4 Unreleased changelog

Proof

• go test -count=1 ./... -coverprofile=...: 85.0% filtered coverage
• go test -count=1 -race ./...
• golangci-lint 2.12.2, go vet, staticcheck 0.7.0, gofumpt 0.10.0, gosec 2.27.1, deadcode 0.47.0
• govulncheck 1.5.0: no vulnerabilities found
• go mod verify and clean go mod tidy
• six-target GoReleaser snapshot build
• built CLI: metadata, status, and authenticated doctor JSON smokes
• Codex autoreview: clean, no accepted/actionable findings

Risk

Low to medium. Workflow/tool changes are version-only; Go source changes are formatter-only. Runtime risk is concentrated in the SQLite 1.52.0 to 1.53.0 update and is covered by the full test, race, built-CLI, and snapshot-release gates.

[steipete]

Landed proof

• Landed commit: af61d96
• Exact landed-main CI: https://github.com/openclaw/discrawl/actions/runs/28521360125 — lint, tests, race detector, dependency integrity, govulncheck, release snapshot, gitleaks, build, and CLI smokes all passed.
• Exact landed-main CodeQL: https://github.com/openclaw/discrawl/actions/runs/28521360326 — passed.
• Exact landed-main Docker: https://github.com/openclaw/discrawl/actions/runs/28521360490 — passed.
• Exact landed-main secret scan: https://github.com/openclaw/discrawl/actions/runs/28521361197 — passed.

Local proof on the final candidate:

• go test -count=1 ./... with filtered coverage: 85.0%
• go test -count=1 -race ./...
• golangci-lint 2.12.2, go vet, staticcheck 0.7.0, gofumpt 0.10.0, gosec 2.27.1, deadcode 0.47.0
• govulncheck 1.5.0: no vulnerabilities found
• go mod verify plus clean go mod tidy
• six-target GoReleaser snapshot build
• built artifact metadata, status, and authenticated doctor JSON smokes against the configured local archive
• Codex autoreview: clean; no accepted/actionable findings

Caveat: no intentional runtime behavior change; Go source churn is formatter-only. Runtime dependency risk is concentrated in the SQLite 1.53.0 update and passed the full local and hosted gates above.