build(deps): consolidate open dependabot updates

[rdimitrov]

Consolidates the five open dependabot PRs into a single change so they can be reviewed and merged together. Each bump was reproduced against current main (go get + go mod tidy for Go modules; the exact SHA pins applied for the actions group), rather than merging the individual branches, to avoid stale go.sum conflicts.

Root module (go.mod)

Dependency	From	To	Supersedes
google.golang.org/grpc	1.82.0	1.82.1	#1479
github.com/prometheus/client_golang	1.23.2	1.24.1	#1475
github.com/danielgtaylor/huma/v2	2.38.0	2.39.0	#1474

Deploy module (deploy/go.mod)

Dependency	From	To	Supersedes
github.com/pulumi/pulumi-kubernetes/sdk/v4	4.32.0	4.33.0	#1449

GitHub Actions (#1476)

• actions/setup-go SHA bumped across ci.yml, release.yml, deploy-production.yml, deploy-staging.yml
• actions/download-artifact v4 → v8.0.1 in close-invalid-publish-prs.yml

go mod tidy re-resolved transitive dependencies in both modules accordingly.

Verification

• go build ./... passes (root + deploy)
• go vet ./... passes
• govulncheck ./... reports no golang.org/x/text finding (the GO-2026-5970 fix from fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) #1481 is preserved; tidy pulled x/text to v0.40.0)

Follow-up

Once this merges, the five superseded PRs (#1479, #1475, #1474, #1449, #1476) can be closed.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Consolidates multiple Dependabot dependency bumps into a single PR across the root Go module, the deploy/ Go module, and several GitHub Actions workflows, keeping the repo’s dependency graph and CI action pins up to date.

Changes:

• Bumped root-module dependencies including google.golang.org/grpc, github.com/prometheus/client_golang, and github.com/danielgtaylor/huma/v2, with corresponding go.sum updates.
• Bumped deploy/ module dependency github.com/pulumi/pulumi-kubernetes/sdk/v4, with corresponding deploy/go.sum updates.
• Updated pinned SHAs for actions/setup-go across workflows and upgraded actions/download-artifact to v8.0.1 (pinned by SHA) in close-invalid-publish-prs.yml.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
go.mod	Updates root module direct/indirect dependency versions to the consolidated set.
go.sum	Refreshes root module checksums to match the updated dependency resolution.
deploy/go.mod	Updates deploy module dependency versions, notably Pulumi Kubernetes SDK.
deploy/go.sum	Refreshes deploy module checksums to match the updated dependency resolution.
.github/workflows/ci.yml	Updates actions/setup-go pinned SHA used by CI jobs.
.github/workflows/release.yml	Updates actions/setup-go pinned SHA used by release jobs.
.github/workflows/deploy-staging.yml	Updates actions/setup-go pinned SHA used by staging deploy workflow.
.github/workflows/deploy-production.yml	Updates actions/setup-go pinned SHA used by production deploy workflow.
.github/workflows/close-invalid-publish-prs.yml	Upgrades pinned actions/download-artifact SHA to v8.0.1 and updates actions/setup-go where applicable.