chore: fix go-git CVEs, sweep deps, clean stray binaries

[franzer]

Summary

Dependency and housekeeping pass. Fixes 3 reachable vulnerabilities in go-git, sweeps dependencies to latest, and removes stray build artifacts from the repo root.

Related Issue

No tracking issue. Vulnerabilities surfaced by govulncheck ./....

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Refactoring (no functional change, significantly cleaner code)

Motivation

govulncheck reported 3 vulnerabilities in go-git v5.16.2 that our code actually reaches (via internal/ignore): GO-2026-4910, GO-2026-4909, GO-2026-4473, all in idx/pack file handling. Dependencies were also broadly stale, and roughly 24MB of compiled binaries had been left untracked in the repo root.

Changes

• Security: bump go-git/go-git v5.16.2 to v5.19.1. govulncheck now reports 0 reachable vulnerabilities.
• Dependency sweep: go get -u ./... to latest. Notable direct bumps:
  • charmbracelet/bubbles v0.21.0 to v1.0.0 (stays on bubbletea v1.3.10, not the v2 migration)
  • alecthomas/chroma v2.20.0 to v2.27.0
  • google/go-containerregistry v0.20.7 to v0.21.7
  • spf13/cobra v1.10.1 to v1.10.2
  • olekukonko/tablewriter v1.0.9 to v1.1.4
  • klauspost/compress off retracted v1.18.1 to v1.19.0
• Cleanup: delete stray root binaries (redactyl, redactyl_tui, redactyl_test) and root-anchor them in .gitignore so they stop appearing as untracked.

Testing

• Unit Tests (go test ./...)
• Integration Tests
• Manual Verification (describe below)

go build ./..., go vet ./..., and the full go test ./... suite pass, including the TUI package. govulncheck ./... reports no vulnerabilities. Manually built the binary and ran a scan against a directory with a realistic secret: detection and table rendering both work after the tablewriter and charm upgrades.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My changes generate no new lint errors
• New and existing unit tests pass locally with my changes

Notes for reviewer

• bubbles v0.21 to v1.0 is a major bump. Unit tests and a headless scan pass, but the interactive TUI could not be driven headlessly. A quick manual redactyl scan in a real terminal before merge is worth it.
• Out of scope, flagged for follow-up: the binary's embedded version reports 1.0.1 (stale ldflags default) while the released tag is v1.0.2.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.