diff --git a/.aqua/aqua-checksums.json b/.aqua/aqua-checksums.json
index 69956de..b644470 100644
--- a/.aqua/aqua-checksums.json
+++ b/.aqua/aqua-checksums.json
@@ -46,53 +46,58 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.7.3/limen_0.7.3_darwin_arm64.tar.gz",
-      "checksum": "E69100548B8ECC30BFCD3239659D4B17D48FDA79F436854680081242ABCBAAF4",
+      "id": "github_release/github.com/farcloser/limen/v0.8.0/limen_0.8.0_darwin_arm64.tar.gz",
+      "checksum": "E73ED78C7076867ACE43D7EBC1A1254CCAE50D5992095B405CAD7F2F10787B89",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.7.3/limen_0.7.3_linux_amd64.tar.gz",
-      "checksum": "C92BFA791A0CE63725F172D2796D33CC36092E5844CF73D8E2F146E8C52409EA",
+      "id": "github_release/github.com/farcloser/limen/v0.8.0/limen_0.8.0_linux_amd64.tar.gz",
+      "checksum": "63A637D15AB78CE8C1ED4CC64CBEE419E467BAADB4FF290C04228D106B0BFF22",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.7.3/limen_0.7.3_linux_arm64.tar.gz",
-      "checksum": "CA1353D91BBFDE0AD4B29BBDEA945FD30E7BDFC739ABAF710FC2F8346BD99EDD",
+      "id": "github_release/github.com/farcloser/limen/v0.8.0/limen_0.8.0_linux_arm64.tar.gz",
+      "checksum": "E2D2BB0DE0D81092D2D590DAB80E71979A0EA883E5F81A3DF59F034703F4E0ED",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.7.3/limen_0.7.3_windows_amd64.tar.gz",
-      "checksum": "A5C43720E9D883CCCFF257EA88AFF6CC6E400983BB76BC26EB609FBD37EDA1A4",
+      "id": "github_release/github.com/farcloser/limen/v0.8.0/limen_0.8.0_windows_amd64.tar.gz",
+      "checksum": "9FF90A269A63C6739FD1AB73FD5262BB98D36145916E0D28D3E873453BDD6D57",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.7.3/limen_0.7.3_windows_arm64.tar.gz",
-      "checksum": "F4DF068E3790E236723AD8E52E6E5D58D684A989DE0EBB6452684B41600D856B",
+      "id": "github_release/github.com/farcloser/limen/v0.8.0/limen_0.8.0_windows_arm64.tar.gz",
+      "checksum": "EF61BC2AD757370C00AD313F2BBD247D7847E8C1A1F8E14FB72EBBCB19FEB12A",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/forkcloser/curl/v8.21.0/curl_8.21.0_darwin_arm64.tar.gz",
-      "checksum": "B2936D3902EC6ED96F9582C00616D2B033B5BB8EC5CB6330101D144482A56F85",
+      "id": "github_release/github.com/farcloser/ossein/v0.3.0/ossein_0.3.0_darwin_arm64.tar.gz",
+      "checksum": "3272F1D1117C2D4F2A8FD484963B0CE8979199D047D0FFA1D110838AB1C16E5F",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/forkcloser/curl/v8.21.0/curl_8.21.0_linux_amd64.tar.gz",
-      "checksum": "EC32B4B26F78F5AD98C64338DC29E67A3C61984E41A95B8792C77457D32DEF73",
+      "id": "github_release/github.com/forkcloser/curl/v8.22.0/curl_8.22.0_darwin_arm64.tar.gz",
+      "checksum": "E733869CF4FED3F5CB0F67E0AA37DD21216690D27C56525749E3F3A211227DD3",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/forkcloser/curl/v8.21.0/curl_8.21.0_linux_arm64.tar.gz",
-      "checksum": "841829B51F1F80FA05BB7382B25E0EBDD765325FA4F8B567461B4FCFB5653B5C",
+      "id": "github_release/github.com/forkcloser/curl/v8.22.0/curl_8.22.0_linux_amd64.tar.gz",
+      "checksum": "0DEE3074F44F56ADBCBB94C3DF506EC60BBFDA31DAA98FA537827C2A290A4666",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/forkcloser/curl/v8.21.0/curl_8.21.0_windows_amd64.tar.gz",
-      "checksum": "DCF632D027EC21B129D06C415C3C008D8DF241BC3516D43FC6B0327C6E35A087",
+      "id": "github_release/github.com/forkcloser/curl/v8.22.0/curl_8.22.0_linux_arm64.tar.gz",
+      "checksum": "C78C61656EC58AB22EA5107B686772811478B91BB97BAD1EADD259C990058EE0",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/forkcloser/curl/v8.21.0/curl_8.21.0_windows_arm64.tar.gz",
-      "checksum": "78EB1B53E55037111534CD2B87AD204DE04318A92C646554A78390BFB60E466F",
+      "id": "github_release/github.com/forkcloser/curl/v8.22.0/curl_8.22.0_windows_amd64.tar.gz",
+      "checksum": "9057B8D7890C58B7254F7207938ECA51C0A43D66B88B1FFD713DD84248941CD9",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/forkcloser/curl/v8.22.0/curl_8.22.0_windows_arm64.tar.gz",
+      "checksum": "4CEBEC6D937A154AE2DC16815E144831CA8F90B85C5E22BA93C6A128518C11DC",
       "algorithm": "sha256"
     },
     {
diff --git a/.aqua/aqua.yaml b/.aqua/aqua.yaml
index 1849a1f..7dbe0c0 100644
--- a/.aqua/aqua.yaml
+++ b/.aqua/aqua.yaml
@@ -26,6 +26,6 @@ packages:
   # are go.mod tools"). aqua's go_install would build it once per tool
   # version, with whichever go ran first, and share that binary.
   # --- farcloser tools (local registry; standard once registered upstream) ---
-  - name: farcloser/limen@v0.7.3 # renovate: depName=farcloser/limen
+  - name: farcloser/limen@v0.8.0 # renovate: depName=farcloser/limen
     registry: local
   - import: ../.limen/aqua.yaml
diff --git a/.github/actions/windows-cache-image/action.yaml b/.github/actions/windows-cache-image/action.yaml
new file mode 100644
index 0000000..99c8db7
--- /dev/null
+++ b/.github/actions/windows-cache-image/action.yaml
@@ -0,0 +1,84 @@
+name: Windows cache image
+description: >
+  Windows only. Holds the Go build and module caches, aqua's root and the linter cache in one NTFS disk image (VHDX), cached as a single file. Restoring that file and attaching it costs under a minute; restoring the same caches as files writes 100,000+ small files, which costs several on the Windows runners. mode attach (before setup-aqua) restores or creates the image, attaches it at C:\vcache, points GOCACHE, GOMODCACHE and AQUA_ROOT_DIR into it, and excludes it from Defender's real-time scan; mode save (last, on a cache miss) detaches it and saves it.
+inputs:
+  mode:
+    description: attach or save.
+    required: true
+  prefix:
+    description: The cache key's prefix, also the restore fallback (attach).
+    required: false
+    default: ''
+  hash:
+    description: What the key varies on, hashed before attach (attach).
+    required: false
+    default: ''
+  key:
+    description: The key attach reported (save).
+    required: false
+    default: ''
+outputs:
+  key:
+    description: The exact cache key.
+    value: ${{ steps.attach.outputs.key }}
+  cache-hit:
+    description: true when the exact key was restored.
+    value: ${{ steps.restore.outputs.cache-hit }}
+runs:
+  using: composite
+  steps:
+    - id: restore
+      if: inputs.mode == 'attach'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: C:\vhd\cache.vhdx
+        key: ${{ inputs.prefix }}${{ inputs.hash }}
+        restore-keys: ${{ inputs.prefix }}
+
+    - name: Attach the image
+      id: attach
+      if: inputs.mode == 'attach'
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+        "key=${{ inputs.prefix }}${{ inputs.hash }}" >> $env:GITHUB_OUTPUT
+        $vhd = 'C:\vhd\cache.vhdx'
+        New-Item -ItemType Directory -Force -Path C:\vhd, C:\vcache | Out-Null
+        if (Test-Path $vhd) {
+          $disk = Mount-DiskImage -ImagePath $vhd -NoDriveLetter -PassThru | Get-Disk
+          $part = Get-Partition -DiskNumber $disk.Number | Where-Object Type -eq 'Basic'
+        } else {
+          # Expandable: the file holds only what is written, so 40 GB is a ceiling.
+          "create vdisk file=`"$vhd`" maximum=40960 type=expandable`nselect vdisk file=`"$vhd`"`nattach vdisk" |
+            Set-Content -Encoding ascii C:\vhd\create.txt
+          diskpart /s C:\vhd\create.txt | Out-Null
+          $disk = Get-DiskImage -ImagePath $vhd | Get-Disk
+          Initialize-Disk -Number $disk.Number -PartitionStyle GPT
+          $part = New-Partition -DiskNumber $disk.Number -UseMaximumSize
+          # NTFS, not a Dev Drive: ReFS measured slower here.
+          Format-Volume -Partition $part -FileSystem NTFS -Confirm:$false -Force | Out-Null
+        }
+        Add-PartitionAccessPath -DiskNumber $disk.Number -PartitionNumber $part.PartitionNumber -AccessPath 'C:\vcache\'
+        # Without it, Defender scans every file on its first read from the
+        # image, and lint pays what the restore saved.
+        Add-MpPreference -ExclusionPath 'C:\vcache', 'C:\vhd'
+        # The linter cache lives under the workspace (main.just pins it there).
+        New-Item -ItemType Directory -Force -Path C:\vcache\golangci, "$env:GITHUB_WORKSPACE\build" | Out-Null
+        New-Item -ItemType Junction -Path "$env:GITHUB_WORKSPACE\build\cache" -Target C:\vcache\golangci | Out-Null
+        "GOCACHE=C:\vcache\go-build" >> $env:GITHUB_ENV
+        "GOMODCACHE=C:\vcache\mod" >> $env:GITHUB_ENV
+        "AQUA_ROOT_DIR=C:/vcache/aqua" >> $env:GITHUB_ENV
+
+    - name: Detach the image
+      if: inputs.mode == 'save'
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+        Remove-Item "$env:GITHUB_WORKSPACE\build\cache" -Force
+        Dismount-DiskImage -ImagePath C:\vhd\cache.vhdx | Out-Null
+
+    - if: inputs.mode == 'save'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: C:\vhd\cache.vhdx
+        key: ${{ inputs.key }}
diff --git a/.limen/aqua.yaml b/.limen/aqua.yaml
index 1a8339c..0b06914 100644
--- a/.limen/aqua.yaml
+++ b/.limen/aqua.yaml
@@ -34,5 +34,9 @@ packages:
   # --- spec tooling (local registry; see .limen/aqua-registry.yaml) ---
   - name: quint-co/quint@v0.33.0 # renovate: depName=quint-co/quint
     registry: local
-  - name: forkcloser/curl@v8.21.0
+  - name: forkcloser/curl@v8.22.0
+    registry: local
+  # darwin/arm64 only. Its `docker` link shadows the machine's Docker on the
+  # hermetic PATH there; aqua skips the package everywhere else.
+  - name: farcloser/ossein@v0.3.0
     registry: local
diff --git a/.limen/just/lib.just b/.limen/just/lib.just
index 0aecc56..25a3899 100644
--- a/.limen/just/lib.just
+++ b/.limen/just/lib.just
@@ -78,6 +78,15 @@ _go-tool name pkg:
         exit 1
     fi
 
+# The Go vulnerability database, fetched once into build/vulndb by `limen
+# vulndb`, which retries (govulncheck's own client does not). Recipes depend
+# on this, then pass govulncheck `-db "$(cat build/vulndb.url)"`.
+_vulndb:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    mkdir -p build
+    ${LIMEN_BIN:-limen} vulndb build/vulndb > build/vulndb.url
+
 # The golangci-lint configuration the lint and fix recipes run: the baseline
 # limen-lint-go embeds with the project's .lint-go.yaml applied, rendered on
 # every run into build/ (gitignored) — so an edit to the overlay is live at
diff --git a/.limen/just/lint.just b/.limen/just/lint.just
index 98fc86a..fe55c12 100644
--- a/.limen/just/lint.just
+++ b/.limen/just/lint.just
@@ -53,12 +53,12 @@ just: (_banner "lint" "just")
         just --fmt --check --justfile "$f"
     done < "$list"
 
-# godolint — hadolint as pure Go (https://github.com/farcloser/godolint) —
+# godolint — hadolint as pure Go (https://github.com/forkcloser/godolint) —
 # over every Dockerfile in the repository; passes vacuously when there are
 # none, so it can sit in the default set for every repo. Rule exceptions
 # belong next to the instruction they excuse, as inline
 # `# hadolint ignore=DLxxxx` pragmas — not in the recipe.
-dockerfile: (_banner "lint" "dockerfile") (_go-tool "godolint" "github.com/farcloser/godolint/cmd/godolint")
+dockerfile: (_banner "lint" "dockerfile") (_go-tool "godolint" "github.com/forkcloser/godolint/cmd/godolint")
     #!/usr/bin/env bash
     set -euo pipefail
     # Same enumeration as `lint just` (through a file, see there), over both
@@ -243,6 +243,20 @@ commits range="": (_banner "lint" "commits") (_go-tool "git-validation" "github.
             fi
         done
     fi
+    # git-validation asks git for every commit's signature status, so git
+    # verifies each signature: without the signers file and a gpg it prints
+    # an error per commit that reads like a failure. GIT_CONFIG_* hands git
+    # both without writing .git/config.
+    n=0
+    if [ -f .lint-signers ]; then
+        export GIT_CONFIG_KEY_0=gpg.ssh.allowedSignersFile GIT_CONFIG_VALUE_0=.lint-signers
+        n=1
+    fi
+    if [ -n "${GPG_BIN:-}" ]; then
+        export "GIT_CONFIG_KEY_$n=gpg.program" "GIT_CONFIG_VALUE_$n=$GPG_BIN"
+        n=$((n + 1))
+    fi
+    export GIT_CONFIG_COUNT=$n
     if [ -n "$range" ]; then
         build/tools/git-validation -run DCO,short-subject,dangling-whitespace -range "$range"
     else
diff --git a/.limen/just/main.just b/.limen/just/main.just
index a774663..f362db9 100644
--- a/.limen/just/main.just
+++ b/.limen/just/main.just
@@ -21,6 +21,11 @@ project := file_name(justfile_directory())
 # homebrew recipes then refuse); override by exporting BREW_BIN.
 export BREW_BIN := env_var_or_default('BREW_BIN', `command -v brew || true`)
 
+# gpg likewise, for git to check a PGP-signed commit (GitHub signs its merge
+# and web-UI commits that way): macOS has none in the base system. Empty when
+# absent; Windows' ambient PATH already carries Git for Windows' own.
+export GPG_BIN := if os() == 'windows' { '' } else { env_var_or_default('GPG_BIN', `command -v gpg || true`) }
+
 # aqua-pinned tools + base system only, so an unpinned tool fails loudly.
 # Windows (git-bash) has no knowable base-system list and uses ';': pins are
 # prepended to the ambient PATH there instead.
diff --git a/.limen/just/security-go.just b/.limen/just/security-go.just
index 7a60b09..92d8c4d 100644
--- a/.limen/just/security-go.just
+++ b/.limen/just/security-go.just
@@ -13,7 +13,7 @@ import 'lib.just'
 default: vuln
 
 # Known-vulnerability scan of the module's dependency graph against the Go
-# vulnerability database (network: govulncheck fetches vuln.go.dev), once per
+# vulnerability database (fetched once, see _vulndb in lib.just), once per
 # supported platform (see _per-platform in lib.just: call paths and
 # dependencies differ by platform). Reports what the module reaches, not what
 # it merely imports: a finding is a call path to cut or a bump to take. No
@@ -29,4 +29,4 @@ vuln: (_banner "security go" "vuln")
     fi
     just do security go _vuln
 
-_vuln: (_go-tool "govulncheck" "golang.org/x/vuln/cmd/govulncheck") (_per-platform "build/tools/govulncheck ./...")
+_vuln: (_go-tool "govulncheck" "golang.org/x/vuln/cmd/govulncheck") _vulndb (_per-platform 'build/tools/govulncheck -db "$(cat build/vulndb.url)" ./...')
diff --git a/.limen/just/security.just b/.limen/just/security.just
index 564c8bf..e6b549d 100644
--- a/.limen/just/security.just
+++ b/.limen/just/security.just
@@ -28,8 +28,8 @@ default: go::default
 # Every Go binary aqua pins carries its own copy of the standard library, built
 # by its upstream with whatever Go they used that day: a fixed net/http or
 # crypto/tls reaches us only when THEY rebuild. This scans each such binary
-# against the Go vulnerability database (network: govulncheck fetches
-# vuln.go.dev), by the symbols it links, so a known standard-library or module
+# against the Go vulnerability database (fetched once, see _vulndb in
+# lib.just), by the symbols it links, so a known standard-library or module
 # vulnerability in a pinned tool is seen the day the advisory lands, whoever
 # built it. The binaries the pinned toolchain builds here (tools/go.mod) are
 # the go vuln lane's; this one is for what we did not build. Enumerated from
@@ -41,9 +41,10 @@ default: go::default
 # vulnerabilities, aqua included, and a red no repository can clear is
 # noise. It joins the default set once the pinned tools are built here with
 # the pinned toolchain and aqua's own pin is current.
-binaries: (_banner "security" "binaries") (_go-tool "govulncheck" "golang.org/x/vuln/cmd/govulncheck")
+binaries: (_banner "security" "binaries") (_go-tool "govulncheck" "golang.org/x/vuln/cmd/govulncheck") _vulndb
     #!/usr/bin/env bash
     set -euo pipefail
+    db=$(cat build/vulndb.url)
     bin="$(aqua root-dir)/bin"
     # A newline-delimited list, not an associative array: macOS ships bash 3.
     seen=$'\n'
@@ -60,7 +61,7 @@ binaries: (_banner "security" "binaries") (_go-tool "govulncheck" "golang.org/x/
         # A darwin universal binary (goreleaser ships one) is beyond govulncheck's
         # reader; the other platforms' legs scan that tool's thin binaries, so
         # the darwin leg says so and moves on rather than failing on a format.
-        if ! out=$(build/tools/govulncheck -mode binary "$path" 2>&1); then
+        if ! out=$(build/tools/govulncheck -db "$db" -mode binary "$path" 2>&1); then
             case "$out" in
                 *"unrecognized binary format"*) echo "  skipped: universal binary, scanned on the other platforms";;
                 *) printf '%s\n' "$out"; fail=1;;
diff --git a/.limen/renovate.json b/.limen/renovate.json
index 27f5137..626a109 100644
--- a/.limen/renovate.json
+++ b/.limen/renovate.json
@@ -74,7 +74,7 @@
       ],
       "matchDepNames": [
         "github.com/vbatts/git-validation",
-        "github.com/farcloser/godolint",
+        "github.com/forkcloser/godolint",
         "github.com/forkcloser/dot",
         "golang.org/x/tools",
         "golang.org/x/vuln",
diff --git a/AGENTS.md b/AGENTS.md
index 64aa589..f45364b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -26,7 +26,9 @@ chapter; the procedure is limen's `skills/contribute`.
   branches — `work`, and anything not named after you — are the human's: never commit
   there unless pairing interactively at their request, and never on `main`.
 - **Commits** are signed as you, with a DCO sign-off as you; when the change is the
-  human's own work, the human is the author. No scratchpads (`AUDIT.md` and its kind).
+  human's own work, the human is the author. No scratchpads (`AUDIT.md` and its kind):
+  they live under `_scratch/` at the repository root, which `.gitignore` ignores, and
+  nowhere else in the tree.
 - **One commit per thing.** Different things get different commits; iteration on the
   same thing — a review round, a fix to your own commit — is squashed into the commit it
   amends before the review is requested. Never a stack of fix-ups for one change.
@@ -54,6 +56,11 @@ chapter; the procedure is limen's `skills/contribute`.
   a one-line workflow bug: on the way through. Onboarding a legacy repository, a
   wholesale cleanup of a broken one: the human decides first. Measure before moving.
 - **A red inherited from `main`** is explained on the pull request, not fixed in it.
+- **A flake is fixed when it is noticed.** A check that fails, then passes on a rerun, gets
+  its root cause and its fix at once, in a pull request of its own: by whoever noticed it,
+  or by the owning session when it is another repository's. The rerun found the flake; it
+  did not fix it. The one exception is a flake whose cause is known and whose fix was
+  declined, documented as such (windows-11-arm's silent exit 4 or 127): it is rerun, and named.
 - **Doctrine can lose the argument, never silently.** A fix that cuts against the book is
   named as such and argued; it is decided, not discovered.
 - **Broken tooling is reported, never worked around in silence.** The rig — limen, the
@@ -126,6 +133,11 @@ chapter; the procedure is limen's `skills/contribute`.
   get wrong at that spot; never provenance, versions, or what the code visibly does. The
   reasoning goes in the commit message. See the book's
   [generic principles](https://github.com/farcloser/limen/blob/main/book/index.md#generic-principles).
+- **A module's `go` directive is the earliest Go release still supported upstream**, as
+  its first version (`go 1.N.0`), or the patch a dependency requires when that is higher
+  (what `go mod tidy` raises it to); never a newer release. The tools modules
+  (`tools/go.mod`, `tools/<name>/go.mod`) are exempt. See the book's
+  [baseline version](https://github.com/farcloser/limen/blob/main/book/per-language.md#go--the-baseline-version).
 - **A `replace` directive is never committed**, nor anything that permits one (a
   `gomoddirectives` `replace-local` or `replace-allow-list`). A local replace is a
   temporary tool for working on two modules in parallel, on your machine, and stays there.
diff --git a/tools/go.mod b/tools/go.mod
index 102b1f7..80d5806 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -6,8 +6,8 @@ module tools
 go 1.27.1
 
 tool (
-	github.com/farcloser/godolint/cmd/godolint
 	github.com/forkcloser/dot/cmd/dot
+	github.com/forkcloser/godolint/cmd/godolint
 	github.com/google/go-licenses/v2
 	github.com/vbatts/git-validation
 	golang.org/x/tools/cmd/deadcode
@@ -15,34 +15,35 @@ tool (
 )
 
 require (
+	github.com/alecthomas/kong v1.16.1 // indirect
 	github.com/containerd/typeurl/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/farcloser/godolint v0.1.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fogleman/gg v1.3.0 // indirect
 	github.com/forkcloser/dot v1.1.1 // indirect
 	github.com/forkcloser/go-graphviz v0.3.1 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/forkcloser/godolint v0.2.0 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/go-licenses/v2 v2.0.1 // indirect
 	github.com/google/licenseclassifier/v2 v2.0.0 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/lmittmann/tint v1.2.1 // indirect
 	github.com/magefile/mage v1.15.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/moby/buildkit v0.31.1 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/moby/buildkit v0.33.1 // indirect
+	github.com/mycophonic/primordium v0.11.1 // indirect
 	github.com/otiai10/copy v1.10.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/rs/zerolog v1.34.0 // indirect
 	github.com/sergi/go-diff v1.2.0 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/sirupsen/logrus v1.10.1 // indirect
 	github.com/spf13/cobra v1.7.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/tetratelabs/wazero v1.12.0 // indirect
-	github.com/urfave/cli/v3 v3.9.0 // indirect
 	github.com/vbatts/git-validation v1.2.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	golang.org/x/image v0.46.0 // indirect
@@ -54,7 +55,7 @@ require (
 	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/tools v0.51.0 // indirect
 	golang.org/x/vuln v1.8.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	mvdan.cc/sh/v3 v3.12.0 // indirect
+	mvdan.cc/sh/v3 v3.14.1 // indirect
 )
diff --git a/tools/go.sum b/tools/go.sum
index f299574..e01fc4d 100644
--- a/tools/go.sum
+++ b/tools/go.sum
@@ -1,11 +1,16 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
+github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/kong v1.16.1 h1:ixhCt93XkJ98kGposQ54+bl0IK6XwqB40AsMynU7Z8E=
+github.com/alecthomas/kong v1.16.1/go.mod h1:wrlbXem1CWqUV5Vbmss5ISYhsVPkBb1Yo7YKJghju2I=
+github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
+github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/containerd/typeurl/v2 v2.3.0 h1:HZHPhRWo5XMy3QGQoPrUzbW/2ckwjfweHmOwlkIrPAQ=
 github.com/containerd/typeurl/v2 v2.3.0/go.mod h1:Qk+PAdUYArVj41TnGi6rJ+48RF0PkcTc4i/taoBcK0w=
-github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -14,8 +19,6 @@ github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymF
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/farcloser/godolint v0.1.0 h1:KQQ5A6rGAk2wVUD2JX8VZquE6ltEW5u4f2QnSEESBZs=
-github.com/farcloser/godolint v0.1.0/go.mod h1:JhI6JkK7kaElq27ZGPyILmJrTs3Sb8HNpC6OORWjRpg=
 github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
@@ -25,11 +28,12 @@ github.com/forkcloser/dot v1.1.1 h1:NT5NFxZvStf71x4+1ub0BefaMeXsW2HwvC63sdU5scY=
 github.com/forkcloser/dot v1.1.1/go.mod h1:OtIsaDD1wEwsjl4elqJOYEjZUml4NUDwsJlFwABAKTk=
 github.com/forkcloser/go-graphviz v0.3.1 h1:AQI7rEdV1f0L2OBLSYSuetN/3IQjdpdIt7udOUJsC8M=
 github.com/forkcloser/go-graphviz v0.3.1/go.mod h1:eAWRQF8m4fwtzgh1U8K+PNiYskteXC6aV4+ft/cinFk=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/forkcloser/godolint v0.2.0 h1:er1xt/Lkt+wKbGdHUkmdrBzIS18JP/GKyTiI5AnvLdg=
+github.com/forkcloser/godolint v0.2.0/go.mod h1:FbOeFurgitrtphsVBS/m9+XeB7ZEqlxw7UR25uFVNs8=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -70,6 +74,8 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -79,6 +85,8 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lmittmann/tint v1.2.1 h1:zOadah+f+nSm3jZM044jOsqh0+vSfgG/d9Ota9a/TLE=
+github.com/lmittmann/tint v1.2.1/go.mod h1:HIS3gSy7qNwGCj+5oRjAutErFBl4BzdQP6cJZ0NfMwE=
 github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
 github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
@@ -86,11 +94,13 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/moby/buildkit v0.31.1 h1:j3p55abBl4kiXXPZgYX+6zWgB2aefqHXoPown12fIzU=
-github.com/moby/buildkit v0.31.1/go.mod h1:YM5iNEbNCc6L1Zt3YWFB/aXNLufvf4Rcu0DPlc9HwQg=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/moby/buildkit v0.33.1 h1:UUrdifmRdRadykO+f5l8BT1CseUXst2sJHV7AmkjjxE=
+github.com/moby/buildkit v0.33.1/go.mod h1:584wW8T/WG4O+lpXUCoDaWEc5e+rTGC3iP+l9mNcX8E=
+github.com/mycophonic/primordium v0.11.1 h1:QZsDEO3DRnFXyuDBSdvKm7S4QPdv1bosRmdVS/Xca0Y=
+github.com/mycophonic/primordium v0.11.1/go.mod h1:hc47mZUgZSBt7YDpDGhxY0QC1+EW6+0wdj6J0bwKYlE=
 github.com/otiai10/copy v1.10.0 h1:znyI7l134wNg/wDktoVQPxPkgvhDfGCYUasey+h0rDQ=
 github.com/otiai10/copy v1.10.0/go.mod h1:rSaLseMUsZFFbsFGc7wCJnnkTAvdc5L6VWxPE4308Ww=
 github.com/otiai10/mint v1.5.1 h1:XaPLeE+9vGbuyEHem1JNk3bYc7KKqyI/na0/mLd/Kks=
@@ -99,21 +109,17 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
-github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
-github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.10.1 h1:xi4336Zh11WpU14fXR6I67V3yaTPQYwRx2WEtHbRg4Q=
+github.com/sirupsen/logrus v1.10.1/go.mod h1:vsQHnG7xzNsxk3NrwboUiWPnIC3dmbjcGPykD7+tiHk=
 github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
 github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
@@ -126,16 +132,16 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=
 github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
-github.com/urfave/cli/v3 v3.9.0 h1:AV9lIiPv3ukYnxunaCUsHnEozptYmDN2F0+yWqLMn/c=
-github.com/urfave/cli/v3 v3.9.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/vbatts/git-validation v1.2.2 h1:AHTS8Jara7Pcu0ub7RusMBAvyLtjsJtF/xPU5Pm1BPE=
 github.com/vbatts/git-validation v1.2.2/go.mod h1:Fj+04EdPcZ0rMOR+dqvppMVVgyNcOFRT5iFWuIc593A=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -167,7 +173,6 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
@@ -210,18 +215,17 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-mvdan.cc/sh/v3 v3.12.0 h1:ejKUR7ONP5bb+UGHGEG/k9V5+pRVIyD+LsZz7o8KHrI=
-mvdan.cc/sh/v3 v3.12.0/go.mod h1:Se6Cj17eYSn+sNooLZiEUnNNmNxg0imoYlTu4CyaGyg=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=