chore(vendor): retire the gokrazy updater fork, accept upstream

Thomas accepts the vendored github.com/gokrazy/updater as upstream ships
it. The local fork is retired, so everything that existed only to
maintain that fork goes with it.

Dependabot PR #10 (merge 2d3c8e7) re-vendored and reverted three of
the four local edits: the two io.LimitReader response caps, the five
http.NoBody request bodies, and slices.Contains in Supports(). Thomas
restored the upstream file, which is now the intended state rather than
a regression.

Removed: the re-apply script, the unmerged upstream patch, and the
marker test that failed when a re-vendor forgot the re-apply. Updated:
the pin table in ai/rules/platform-linux.md, and the govulncheck
workflow comment that named the marker test as the merge-gating
supply-chain guard. No always-run supply-chain guard gates merges now.

The appliance updater reads device responses with no size cap.

plan/learned/1195, 1233, 1254 and 1255 still name the deleted files.
Those are history and stay as written.
plan/spec-ipsec-opaque-selector-port-mask.md cites the fork as the
precedent for its route 1. It is a skeleton with no code, and Thomas
chose to leave it.

Author: thomas-mangin

.github/workflows/govulncheck.yml

@@ -9,9 +9,10 @@ name: govulncheck
 # default): the scan needs a network fetch of the vuln DB, and a transient fetch
 # failure or a newly published advisory must NOT wedge the fast merge gate. So it
 # is deliberately absent from `stagesForMode` (scripts/status/verify_run.go) and
-# never runs under `make ze-verify` / verify.yml. The always-run, deterministic
-# supply-chain guard that DOES gate merges is the vendored-updater fix-marker test
-# (internal/appliance/updater_hardening_markers_test.go), part of the unit suite.
+# never runs under `make ze-verify` / verify.yml. No always-run supply-chain guard
+# gates merges. The vendored-updater fix-marker test held that role until
+# 2026-08-05, when the local fork of `github.com/gokrazy/updater` was retired and
+# the vendored code returned to upstream. This scheduled scan is the only SCA.
 #
 # It shares one source of truth for the invocation with the on-demand path: the
 # `ze-vulncheck` make target. No push/pull_request trigger -- the dev loop stays

ai/rules/platform-linux.md

@@ -497,6 +497,6 @@ and `proxy.golang.org/<mod>/@v/list` return an empty version list for every one,
 | `github.com/packetcap/go-pcap` | pseudo-version | none published |
 | `golang.zx2c4.com/wireguard/wgctrl` | pseudo-version | none published |
 | `github.com/gokrazy/tools` | pseudo-version | none published |
-| `github.com/gokrazy/updater` | pseudo-version | none (hard fork; see `scripts/dev/reapply-updater-fixes.py`) |
+| `github.com/gokrazy/updater` | pseudo-version | none published |
 
 **Keep the pseudo-versions. Re-check for a first tag when bumping any of these, and move the pin to a tag the day upstream cuts one.** Until then a pseudo-version is the only available form and is legal. The note exists so a future reviewer does not "fix" a non-problem or assume the pins were never examined.