build(deps): low-risk batch -- docker digest, go group, npm group (supersedes #204/#205/#207)

[alicoding]

Summary

One deliberate, tested branch superseding Dependabot's low-risk PRs. Excludes #206/#208 (Wails beta bumps) per scope.

#204 -- Docker digest (build/docker/Dockerfile.cross)

• golang:1.26-bookworm base image digest bump (no version change, digest-only).

#205 -- Go dependencies group (go.mod / go.sum)

• dbos-inc/dbos-transact-golang 1.0.0 -> 1.1.0
• santhosh-tekuri/jsonschema/v6 6.0.2 -> 6.0.3
• yuin/goldmark 1.8.2 -> 1.8.5
• golang.org/x/net 0.56.0 -> 0.58.0
• modernc.org/sqlite 1.54.0 -> 1.56.0
• go mod tidy transitives (matching Dependabot's go.sum exactly): x/mod 0.37.0->0.38.0, x/text 0.40.0->0.41.0, x/tools 0.47.0->0.48.0, mattn/go-isatty 0.0.23->0.0.24, modernc.org/libc 1.74.3->1.74.4, google/pprof bump.

#207 -- npm dependencies group (frontend/)

• @faker-js/faker 10.5.0 -> 10.6.0
• @primer/react 38.35.0 -> 38.35.1
• @xyflow/react 12.11.2 -> 12.11.3
• papaparse 5.5.4 -> 5.6.0
• react-querybuilder 8.22.4 -> 8.23.0
• zustand 5.0.14 -> 5.0.15
• dependency-cruiser 18.1.1 -> 18.2.0 (dev)
• globals 17.9.0 -> 17.11.0 (dev)

Gates run

• Go: go vet ./... clean; go test . ./internal/... -race -count=1 all packages pass; go build -tags server and go build (desktop) both green.
• npm: npm run build:dev pass; npx tsc --noEmit pass; npx eslint . --max-warnings=0 -- 9 pre-existing warnings (react-hooks/exhaustive-deps, react-refresh) in files untouched by this bump, not fixed (out of scope); npx vitest run --coverage -- 61/61 test files, 551/551 tests pass, coverage thresholds met.
• Full e2e (npx playwright test): 347 passed, 5 flaky (pass on retry, all pre-existing frontend/e2e/QUARANTINE.md entries), 1 skipped, 3 failed all retries -- all three accepted as unrelated to this bump:
  • composition-canvas-interactions.spec.ts:25 -- already quarantined, documented pre-existing on unmodified main.
  • layout.spec.ts:173 and state-persistence.spec.ts:166 -- both trip the same BuildIdentityBadge staleness check. go version -m on the rebuilt server binary showed vcs.revision resolving to the main checkout's HEAD rather than this worktree's own HEAD, reproduced even after go build -a forced a full relink -- a Go/git-worktree VCS-stamping artifact from the main checkout advancing during this session, not a source or dependency regression. CI builds from a fresh clone (no worktree/main HEAD divergence), so this does not affect the required gate.

Test plan

• Docker digest matches Dependabot's diff exactly (no local gate exercises Docker builds)
• Go group: vet/test/both builds green
• npm group: build/tsc/vitest green, e2e green apart from the 3 accepted/explained failures above

🤖 Generated with Claude Code

https://claude.ai/code/session_01FW5GkkAG8du7tNdYLk2zSd