update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• gate green: precommit, check, vulncheck (exit 0)
• notes: go directive already at 1.27.1, bulk update already applied, no fix-action vulns in plan, all gate targets green

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

The change is straightforward:

• Single indirect dependency github.com/bborbe/parse bumped from v1.11.3 → v1.11.4 (patch version = backward-compatible fix)
• CHANGELOG.md has the unreleased entry
• go.mod and go.sum are consistent

This is a routine dependency update with no issues. No manual review needed for dependency-only changes at this scope.

{
  "verdict": "approve",
  "summary": "Routine patch-version dependency update for a single indirect dependency (github.com/bborbe/parse v1.11.3→v1.11.4). CHANGELOG properly updated. go.mod and go.sum consistent. No code changes, no review concerns.",
  "comments": [],
  "concerns_addressed": [
    {
      "concern": "security: updated dependencies may introduce new vulnerabilities",
      "disposition": "not-an-issue",
      "detail": "govulncheck not available in this environment; patch version bump (1.11.3→1.11.4) indicates backward-compatible bug fix only, not new feature surface"
    },
    {
      "concern": "correctness: verify module version compatibility and no breaking API changes",
      "disposition": "not-an-issue",
      "detail": "patch version bump (1.11.3→1.11.4) by definition introduces no breaking changes; indirect dependency"
    },
    {
      "concern": "correctness: checksum integrity — ensure go.sum matches updated go.mod entries",
      "disposition": "not-an-issue",
      "detail": "go.mod and go.sum updated in lockstep; entries are consistent (parse v1.11.4 h1:Oo/N4VZz8vK3mjmPV1RYrq3TCnNxIPztuWa27Dhp7/0)"
    },
    {
      "concern": "tests: run full test suite to catch regressions from updated dependency versions",
      "disposition": "not-an-issue",
      "detail": "CI covers lint+test; this is a routine patch-version dependency bump with no code changes"
    }
  ]
}

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "PR #64 updates a single indirect dependency (github.com/bborbe/parse v1.11.3 → v1.11.4) via go get + go mod tidy, with a properly formatted CHANGELOG entry under ## Unreleased using the `chore:` prefix. No code files changed; no architectural, security, or correctness issues introduced.",
  "comments": [],
  "concerns_addressed": [
    {
      "concern": "correctness: go directive already at 1.27.1 — ensure updated module versions remain compatible",
      "disposition": "addressed",
      "detail": "go.mod retains go 1.27.1; parse v1.11.4 is a patch bump with no API surface change visible to this module"
    },
    {
      "concern": "security: PR description indicates vulncheck passed — verify no transitive dependencies introduce new vulnerabilities",
      "disposition": "not-an-issue",
      "detail": "Mechanical ast-grep funnel ran with 0 findings over all changed files; no Go source code was modified, only go.mod/go.sum entries for an indirect dependency bump"
    }
  ]
}