CP-29639: combined dependency updates

[dmepham]

Rolls up the open Dependabot backlog into a single branch so it lands in one CI run instead of ~20 serialized runs (each of which invalidates the next PR's go.mod and forces a re-run). Built off current develop (which already includes the CVE stack #945 and the bumps merged directly: #914, #927, #928, #913, #932).

Once this merges, the individual Dependabot PRs it folds in are superseded and will be closed with a reference back here.

Folded in

• Root Go: k8s.io/api apimachinery client-go → v0.36.3; prometheus/common → v0.70.1; prometheus/client_golang → v1.24.1; sigs.k8s.io/gateway-api → v1.6.1; go-chi/chi/v5 → v5.3.1; mattn/go-sqlite3 → v1.14.49; golang.org/x/sync → v0.22.0
• tests Go: k8s.io/api, k8s.io/apimachinery → v0.36.3
• .tools Go: gofumpt → v0.11.0; helm.sh/helm/v3 → v3.21.3 (with controller-runtime → v0.24.1, the compile fix from CP-29639: Bump helm.sh/helm/v3 from 3.21.1 to 3.21.3 in /.tools #918)
• .tools npm: markdownlint-cli2 → 0.23.2 (lockfile refreshed)
• Workflows: actions/setup-go v6→v7; docker/metadata-action → v6.2.0; docker/setup-buildx-action → v4.2.0; renovatebot/github-action → v46.2.1

Not included

• CP-29639: Bump kube-state-metrics from 5.36.* to 8.1.3 in /helm #940 (kube-state-metrics 5.x → 8.1.3) — intentionally excluded; too large a version jump to bundle here.

Verification (in worktree, all green)

go mod tidy ×3 modules · make generate · make format (no additional diff) · ./scripts/ci-checks.sh · make install-tools-go (helm/v3 + controller-runtime compile gate) · go build ./...

[greptile-apps]

Greptile Summary

This PR consolidates routine dependency updates across the application, test, and development-tool modules and refreshes the associated checksums and npm lockfile.

• Updates Kubernetes, Prometheus, HTTP routing, SQLite, Gateway API, and Go support libraries.
• Updates Helm, gofumpt, markdownlint, and their resolved transitive dependencies.
• Advances selected GitHub Actions used by CI, image builds, releases, Renovate, and Kubernetes test matrices.

Confidence Score: 5/5

The PR appears safe to merge because the changes are internally consistent dependency updates and no concrete changed-code failure remains.

The upgraded modules and workflow actions preserve their existing integration contracts, while the reported formatting, generation, CI, application-build, and tools-module compile checks cover the principal compatibility boundaries.

Important Files Changed

Filename	Overview
go.mod	Updates application dependencies through compatible patch and minor releases without changing application source or public contracts.
tests/go.mod	Aligns test-module dependency versions with the root module and retains the local replacement for the application module.
.tools/go.mod	Updates Helm, gofumpt, controller-runtime, and their resolved dependency graph; the reported tools compile gate passed.
.tools/package-lock.json	Refreshes the npm resolution and integrity metadata consistently with markdownlint-cli2 0.23.2.
.github/workflows/golang-ci.yml	Updates setup-go from v6 to v7 across existing CI jobs without changing job logic or inputs.
.github/workflows/docker-build.yml	Advances the SHA-pinned Docker Buildx and metadata actions while preserving build and publication behavior.
.github/workflows/release-to-main.yml	Updates setup-go for the release workflow without changing its release, merge, tagging, or push sequence.
.github/workflows/renovate.yml	Advances the self-hosted Renovate action while retaining its existing configuration, token, and container setup.

_{Reviews (1): Last reviewed commit: "CP-29639: combined dependency updates" | Re-trigger Greptile}