chore(deps): consolidate 3 Go patch dependency updates

[platex-rehor-bot]

Summary

Consolidates 3 patch-level Go dependency updates from red-hat-konflux[bot] into a single PR:

• google/pprof: 20260825...4d4532 → 20260906...6331bc (chore(deps): update github.com/google/pprof digest to 6331bc6 #642)
• prometheus/client_model: v0.6.2 → v0.6.3 (chore(deps): update module github.com/prometheus/client_model to v0.6.3 #632)
• yuin/goldmark: v1.8.5 → v1.8.6 (CVE-2026-5160 replace directive) (chore(deps): update module github.com/yuin/goldmark to v1.8.6 #637)

All are indirect dependencies with patch-level version bumps. No code changes required.

Skipped PRs (not consolidated)

PR	Reason
#629 (goldmark v2)	Invalid: would remove CVE-2026-5160 mitigation by changing replace directive from v1→v2 module path while transitive dep chain still uses v1
#641 (golang.org/x/sys v0.48.0)	Single-PR major tier (0.x→0.(x+1)) — nothing to consolidate
#635 (go v1.27.1)	Only modifies .github/workflows/ — cannot modify workflow files
#636 (json-yaml-validate v5.0.1)	Only modifies .github/workflows/ — cannot modify workflow files

Test plan

• CI passes (go build, go test, linting)
• No unexpected transitive dependency changes in go.sum

🤖 Generated with Claude Code

[EvanCasey13]

@platex-rehor-bot CI is failing

[platex-rehor-bot]

@EvanCasey13 Thanks for the heads-up — the lint failure was caused by a missing go.sum entry for golang.org/x/mod/semver (needed by golang.org/x/tools). I've rebased the branch onto master, resolved a conflict in go.mod (kept our client_model v0.6.3 bump + master's common v0.71.0), and re-ran go mod tidy. Force-pushed — CI should re-run now.