fix(deps): bump golang.org/x/text to v0.39.0 (CVE-2026-56852)

[bborbe]

Fleet security update. golang.org/x/text v0.38.0 -> v0.39.0 (CVE-2026-56852). CHANGELOG under ## Unreleased; release agent versions on merge; no tag.

[ben-s-pull-request-reviewer]

Based on my analysis, here's the review:

Changes verified:

• go.mod: golang.org/x/text bumped v0.38.0 → v0.39.0 (CVE fix); golang.org/x/tools also bumped v0.46.0 → v0.47.0 (transitive)
• go.sum: checksums consistent with new versions
• CHANGELOG.md: new ## Unreleased section added

Issue found: CHANGELOG.md has two ## Unreleased headers (one pre-existing for plan-goal fix, one added for this CVE bump) — should be a single merged section.

Version alignment: All four version strings (CHANGELOG.md top entry v0.101.0, plugin.json, marketplace.json metadata, marketplace.json plugins[0]) are aligned at 0.101.0. ✓

{
  "verdict": "approve",
  "summary": "Security dependency bump (golang.org/x/text v0.38.0 → v0.39.0) correctly addresses CVE-2026-56852. go.sum checksums are consistent, version alignment is intact, and CHANGELOG.md documents the change. One minor cosmetic issue: CHANGELOG.md has duplicate '## Unreleased' headers that should be merged.",
  "comments": [
    {
      "file": "CHANGELOG.md",
      "line": 14,
      "severity": "minor",
      "message": "Should Fix (Important): Duplicate '## Unreleased' header — CHANGELOG.md already had an Unreleased section (line 14) for the plan-goal fix. This commit added a second one below it. Merge both bullet points into a single '## Unreleased' section."
    }
  ],
  "concerns_addressed": [
    "security: CVE-2026-56852 fixed — golang.org/x/text v0.38.0 → v0.39.0 in go.mod:46",
    "correctness: golang.org/x/text pinned correctly to v0.39.0 in go.mod:46",
    "correctness: go.sum checksums match new go.mod dependencies (verified h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=)",
    "correctness: CHANGELOG.md documents CVE fix — 'Bump golang.org/x/text to v0.39.0 (CVE-2026-56852)' added under new Unreleased section"
  ]
}