chore: pin mockgen and govulncheck as go tools

[jahvon]

Summary

CI generated mocks with mockgen v0.4.0 while go.mod pins the gomock library at v0.6.0, so any machine with a newer mockgen rewrote every mock on flow generate. install tools only installed a tool when it was missing, so a version already on the shared GOBIN (from another repo) was never corrected, and govulncheck ran at @latest.

mockgen and govulncheck are now tool directives in go.mod, run with go tool. The generator always matches the gomock library, local and CI runs use the same versions, and dependabot bumps them with the rest of go.mod.

Notable Changes

• go:generate directives call go tool mockgen; CI no longer installs mockgen separately. Mocks are regenerated at v0.6.0.
• scan security runs go tool govulncheck.
• install tools reinstalls cobra-cli and goreleaser whenever the installed version differs from the pin, and no longer installs the unused ginkgo CLI. These stay out of go.mod because their dependency trees would leak into the module graph of pkg/ consumers.
• docs/development.md lists where each tool's version lives.

No ticket

[jahvon]

Verification

• flow validate passed (generate, lint 0 issues, unit + e2e, schemas).
• With ~/go/bin removed from PATH (no global mockgen), go generate ./internal/... ./pkg/... succeeded through go tool mockgen; output is the same 7 mock files committed here.
• CI=true flow scan security on go tool govulncheck (v1.9.0): 2 results, both note, 0 duplicate stacks.
• install tools: version parsing reads v1.3.0 / v2.12.5 for the installed binaries and empty for a missing one (which triggers an install).
• Not verified: the CI validate-generated job without the mockgen install step; that runs only in Actions.

Worth a close look

• go.mod gains golang.org/x/vuln (and newer golang.org/x/*) through the govulncheck tool. Consumers of pkg/ see these in their module graph; golangci-lint, goreleaser and cobra-cli were kept out of go.mod for that reason.
• fix(secret): keep piped multi-line secrets and mask them #489 also bumps golang.org/x/*. Whichever merges second needs go mod tidy.

Out of scope (follow-up)

• goreleaser is still pinned in two places (.execs/tools.flow, .github/workflows/release.yaml), and the golangci-lint go run …@v2.5.0 pin isn't bumped by dependabot.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!