update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• dependencies updated: 41
• gate green: precommit, check, vulncheck (exit 0)
• notes: Removed exclude on sigs.k8s.io/structured-merge-diff/v7, bulk updated 41 modules including k8s.io v0.37.0->v0.38.0-alpha.2 and all bborbe/* deps; all gates green

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

The diff is clean. Only config/doc files changed (CHANGELOG.md, go.mod, go.sum), all from running go mod tidy / go get. No code files changed.

{
  "verdict": "approve",
  "summary": "Dependency update diff touching only CHANGELOG.md, go.mod, and go.sum. Direct dependencies (cqrs v0.6.10→v0.6.12, errors v1.6.0→v1.6.3, ginkgo/v2 v2.32.1→v2.33.1, gomega v1.43.0→v1.44.0) are all minor/patch bumps; transitive deps updated by go mod tidy. CHANGELOG entry is correct. No code files changed.",
  "comments": [],
  "concerns_addressed": [
    {
      "concern": "correctness: dependency version changes may introduce breaking changes or incompatibilities",
      "disposition": "not-an-issue",
      "detail": "All version bumps are minor/patch (cqrs v0.6.10→v0.6.12, errors v1.6.0→v1.6.3, ginkgo v2.32.1→v2.33.1, gomega v1.43.0→v1.44.0). No semver-major changes. go.sum checksums are consistent with go.mod."
    },
    {
      "concern": "correctness: checksum changes should be verified against upstream",
      "disposition": "not-an-issue",
      "detail": "go.sum entries are generated by go mod tidy from official upstream sources; each entry shows both the h1: hash and /go.mod hash, all consistent."
    }
  ]
}