update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• dependencies updated: 5
• gate green: precommit, check, vulncheck (exit 0)
• notes: Bumped kafka, kv, metrics, vault-cli; added replace directive for k8s.io/kube-openapi to resolve structured-merge-diff v6/v7 type conflict; all gates green

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

Based on my analysis of the diff, let me verify the key aspects of this dependency update:

Changes verified:

1. go.mod - 3 direct dependencies updated: kafka v1.25.15→v1.25.16, metrics v0.6.2→v0.6.3, vault-cli v0.126.1→v0.126.3; plus 1 indirect (kv v1.21.13→v1.21.14). A replace directive for kube-openapi was also added.

2. go.sum - All checksums match the updated module versions correctly.

3. CHANGELOG.md - Unreleased section added documenting all three direct dependency updates.

Assessment:

• The replace directive for k8s.io/kube-openapi appears to resolve a version conflict (upgraded from an older pinned version to a newer one, both indirect).
• The exclude for sigs.k8s.io/structured-merge-diff/v7 v7.0.0 is an additional safety exclusion.
• All updates are patch/minor bumps (semver-compatible).
• CHANGELOG properly documents the changes.
• The mechanical funnel found 0 findings.

This is a routine dependency update following project conventions. Let me produce the verdict:

{
  "verdict": "approve",
  "summary": "Routine Go module dependency update with no issues found. Three direct dependencies (kafka, metrics, vault-cli) and one indirect (kv) were updated to patch/minor versions. go.sum checksums are consistent with go.mod entries. CHANGELOG is properly updated. The added replace directive for kube-openapi and exclude for structured-merge-diff/v7 follow standard Go module management practices.",
  "comments": [],
  "concerns_addressed": [
    {
      "concern": "security: Verify updated dependencies have no known vulnerabilities",
      "disposition": "not-an-issue",
      "detail": "Dependency updates are patch/minor semver-compatible bumps. No known CVEs flagged by mechanical funnel. ast-grep scan found 0 findings."
    },
    {
      "concern": "correctness: Ensure go.sum checksums match go.mod entries exactly",
      "disposition": "addressed",
      "detail": "Verified all changed entries in go.sum match corresponding go.mod require entries: kafka v1.25.16 (h1:Rd9ns...), metrics v0.6.3 (h1:2WW5t...), vault-cli v0.126.3 (h1:o7a9I...), kv v1.21.14 (h1:B7L4B...). All checksums present and correct."
    },
    {
      "concern": "correctness: Check for indirect dependency changes that may affect build",
      "disposition": "not-an-issue",
      "detail": "Indirect changes are minimal: kv updated patch version, kube-openapi replace directive upgraded to newer version. Both are routine. exclude directive for structured-merge-diff/v7 added as safety measure."
    }
  ]
}