Update dependencies

[dreikanter]

Summary

• Refreshed every module dependency to its latest version. The direct requirements (cobra, pflag, testify) and golangci-lint itself were already current, so the churn is entirely in the linter's transitive tree — gosec 2.26.1 → 2.28.0, revive, go-critic, the golang.org/x/* set, and ~80 others.
• Bumped the go directive from 1.25.0 to 1.25.8. The updated gosec requires it, and Go rewrote the directive itself during the upgrade; building from source now needs Go 1.25.8 or newer.
• go build ./..., make test, and make lint all pass on the updated tree (0 lint issues).

Checklist

• Updated CHANGELOG.md under Unreleased, or change is internal-only