fix(security): go security fixes (2026-09-14)

[github-actions]

Included fixes

• CVE-2026-84445 (high): gRPC-Go xDS missing authority/Host-header denial of service — google.golang.org/grpc 1.83.1 → 1.83.2
• CVE-2026-53495 (moderate): containerd CRI ExecSync goroutine-leak denial of service — github.com/containerd/containerd/v2 2.2.5 → 2.2.8

Risks

None. The included changes are patch updates; transitive dependencies moved only forward as required by the patched modules.

Skipped (already satisfied / would downgrade)

• CVE-2026-84303 and CVE-2026-84304: google.golang.org/grpc was already 1.83.1, outside each advisorys vulnerable range (<= 1.83.0).

Skipped (build incompatibility)

• CVE-2026-61711 / GHSA-7236-3392-c5c6: github.com/moby/buildkit 0.29.0 → 0.31.1 fails to build because github.com/docker/compose/v5@v5.1.2 imports the removed package github.com/moby/buildkit/util/tracing/env. The change was reverted.

Verification

• go -C bulker work sync
• go -C bulker/ build ./... (13 modules)