chore(deps): consolidate 5 Go minor dependency updates

[platex-rehor-bot]

Summary

Consolidates 5 bot dependency update PRs into a single PR for easier review:

PR	Package	Version Change	Tier
#633	github.com/aws/aws-sdk-go-v2 (+ credentials, cloudwatchlogs, internal sub-packages)	v1.45.1 → v1.47.0	Minor
#641	golang.org/x/sys	v0.47.0 → v0.48.0	Minor
#646	golang.org/x/net	v0.58.0 → v0.59.0	Minor
#647	golang.org/x/text	v0.41.0 → v0.42.0	Minor
#650	golang.org/x/tools	v0.49.0 → v0.50.0	Minor

Breaking-change skim (minor tier)

• AWS SDK v1.45.1 → v1.47.0: Release notes show only additive "Feature" entries (schema-based serialization for various services, new APIs). No breaking changes, removals, or deprecations. This repo uses only cloudwatchlogs.New(), credentials.NewStaticCredentialsProvider, and aws.NewCredentialsCache — all unchanged.
• golang.org/x/ packages*: All are indirect dependencies (used by test frameworks and build tools). No direct imports in application code. Standard library extensions with no breaking changes in these minor bumps.

Code changes made

No code changes were required — all updates are backward-compatible.

Skipped PRs

PR	Reason
#629 (goldmark v1 → v2)	Invalid — would remove CVE-2026-5160 XSS mitigation. The existing replace directive pins goldmark v1 to v1.8.6 for security. This PR changes the replace to target goldmark/v2, which is a different Go module path not required by any dependency in the tree. Applying it would leave goldmark v1 resolving to v1.4.13 (vulnerable).
#635 (Go toolchain v1.27.1)	Touches only .github/workflows/golangci-lint.yml — cannot push (PAT lacks workflow scope)
#636 (json-yaml-validate v5.0.1)	Touches only .github/workflows/json-yaml-validation.yml — cannot push (PAT lacks workflow scope)

Preflight misclassification note

The preflight classified this repo's PRs as go:major×5 and python:minor×3. This repo is Go-only (no Pipfile, no package.json). The python:minor group contained Go and GitHub Actions PRs misclassified due to the preflight's diff-based ecosystem detection lacking a "github-actions" category. The go:major classification for golang.org/x/* v0.x packages was also incorrect — these are stable standard library extensions where 0.x → 0.(x+1) follows minor semver semantics (documented precedent from prior cycles).

🤖 Generated with Claude Code

[EvanCasey13]

@platex-rehor-bot CI is failing

[platex-rehor-bot]

Thanks for flagging @EvanCasey13. I investigated — the code builds and all tests pass locally (including with -race), and the branch is up to date with master. The Konflux pipeline logs aren't accessible right now (401), so I couldn't determine the exact failure cause. It may have been a transient infrastructure issue.

I've pushed a no-op commit to retrigger the Konflux pipeline. Will monitor the results.