chore(security): bump x/net & x/text, pin CI actions to commit SHA

[carlosflorencio]

Independent security review found the template still carried the vulnerable transitive Go versions and floating CI action tags; this patch aligns it with the security baseline already applied in kandev-plugin-kandy#4 so new plugins inherit the safer defaults.

Changes

• Bump golang.org/x/net 0.55.0 → 0.56.0 for GO-2026-5942 / CVE-2026-46600.
• Bump golang.org/x/text 0.37.0 → 0.39.0 for GO-2026-5970 / CVE-2026-56852.
• Carry golang.org/x/sys to 0.46.0 as the required transitive update.
• Pin checkout, setup-go, and release actions to audited commit SHAs with tag comments.

Floating runner labels and the SDK checkout ref remain unchanged and out of scope.

Validation

• go mod tidy is idempotent.
• gofmt, go vet ./server/..., and make test pass.
• make package-host passed; the archive contained the manifest, host executable, UI bundle, and checksums.
• Workflow pin audit and git diff --check pass.

---

Summary by cubic

Hardened security by updating golang.org/x/net and golang.org/x/text to patched versions and pinning CI actions to commit SHAs. This removes known CVE exposure and locks workflows to audited code.

• Dependencies

  • Bump golang.org/x/net to v0.56.0.
  • Bump golang.org/x/text to v0.39.0.
  • Carry golang.org/x/sys to v0.46.0 as a transitive update.

• CI

  • Pin actions/checkout, actions/setup-go, and softprops/action-gh-release to audited commit SHAs.
  • Runner labels and SDK checkout ref remain unchanged.

^{Written for commit 37ec1f9. Summary will update on new commits.}