deps: bump to the released fixes, for a v1.13.8 that actually carries them

[TeoSlayer]

Six modules were released today with fixes from a codebase-wide sweep — but this repo still pinned the versions from before them.

Tagging a release in that state would have shipped a binary carrying none of the fixes. The version number would move and nothing would actually change.

module	was	now	fix it carries
handshake	v0.2.6	v0.2.7	port 444 leaked a goroutine + 64 KiB per accepted connection (Close appeared nowhere in the file)
beacon	v0.2.8	v0.2.9	dstNodes grew unbounded from unauthenticated datagrams, in no sweep
rendezvous	v0.2.7	v0.2.8	RateLimiter.Allow had zero call sites — per-IP tier was dead code
dataexchange	beta pseudo	v0.2.1	peer-chosen transfer ids opened an *os.File each, no cap → FD exhaustion
eventstream	v0.2.2	v0.2.3	time.After per subscriber per event pinned up to 500*S timers
runtime	—	v0.3.2	already bumped with #435; listed for completeness

trustedagents, policy and webhook are deliberately not bumped — their newest tags are betas and this repo tracks stable.

Verified the fixes are really there

Rather than trusting version strings, I grepped the resolved module cache for the actual code:

handshake@v0.2.7     close-on-exit defer + handshakeCloseDelay   ✅
dataexchange@v0.2.1  maxConcurrentTransfers                      ✅
beacon@v0.2.9        dstNodes.Range sweep                        ✅
eventstream@v0.2.3   writeTimeout := time.NewTimer               ✅
rendezvous@v0.2.8    rateLimiter.Allow(host)                     ✅
runtime@v0.3.2       streamAdapter.SetReadDeadline               ✅

Built and tested with GOWORK=off so resolution matches CI rather than the local go.work overlay: build clean, vet clean, pkg/daemon suite green.

Once this lands, tagging v1.13.8 produces a release that genuinely incorporates the whole sweep.

🤖 Generated with Claude Code