build(deps): refresh tool pins

[github-actions]

Automated pin refresh — python3 update_pins.py --soak 7, run by pins-updater.yml.

Review the diff and let CI build the image before merging. The ⚠ needs your eyes block below covers the manual pins (nodejs, task, go, ubuntu base) that the script reports but never rewrites — act on those in a separate commit.

update_pins.py report

update_pins  (soak window: 7 days)
  resolving ──────────────────────────────────────────────────
  … claude-code
  … openspec
  … pnpm
  … uv
  … glab
  … tfenv
  … awscli

  results ────────────────────────────────────────────────────
  ✓ claude-code  2.1.233 → 2.1.241   (8d)
      ↳ 2.1.251 available but inside soak (2d) — held
  ✓ openspec     1.9.0 → 1.10.0   (11d)
      ↳ 1.11.0 available but inside soak (4d) — held
  ✓ pnpm         11.22.0 → 11.23.0   (7d)
      ↳ 12.1.0 available but inside soak (1d) — held
  • uv           0.12.5   unchanged (already newest soaked); integrity re-verified (2 artifacts)
      ↳ 0.12.7 available but inside soak (3d) — held
  ✓ glab         1.113.0 → 1.114.0   (12d)
      ↳ 1.115.0 available but inside soak (5d) — held
  • tfenv        3.2.2   unchanged (already newest soaked); integrity re-verified (1 artifact)
  ✓ awscli       2.36.24 → 2.36.29   (9d)
      ↳ 2.36.34 available but inside soak (2d) — held

  ⚠ needs your eyes (manual pins) ─────────────────────────────
  ⚠ nodejs        pinned 24.19.0-1nodesource1  — bump via the NodeSource note in the Dockerfile
  ⚠ task          pinned 3.53.1  (matches newest in the 'resolute' apt suite)
  ⚠ go            pinned 1.26.6  latest stable → 1.27.0  (bump via the go.dev note in the Dockerfile — hashes too)
  ⚠ ubuntu base   pinned sha256:2260313b31c8…  (matches current ubuntu:26.04 tag)

  wrote pins/*.env — review the diff, build to test, then commit.