chore: update dependencies (v0.2.2)

[bborbe]

Dependency refresh to clear the fleet-wide BuildStale warning on the agent-task-controller-openclaw and agent-task-controller-personal dev pods (pinned image was 8 days old at v0.2.1, no code change → alert fires by design on a correctly-pinned mirror service).

Bumps 16 bborbe libs + prometheus/client_golang, prometheus/common, sentry-go, golang.org/x tooling, and sigs.k8s.io/structured-merge-diff/v6. make precommit green (build/lint/tests/gosec/vulncheck — 0 vulnerabilities). CHANGELOG finalized to v0.2.2, tag already pushed.

Merge → build+push v0.2.2 image → bump quant/agent pins → deploy dev → fresh build_info clears the alert.

[ben-s-pull-request-reviewer]

{
  "verdict": "request-changes",
  "summary": "PR #10 'chore: update dependencies (v0.2.2)' bumps all direct dependencies and updates the CHANGELOG with v0.2.2 release notes. Two mechanical findings survive adjudication: a MUST-tier tools.go violation (CLI tool import in direct dependencies rather than tools.env) and a SHOULD-tier CHANGELOG issue (missing ## Unreleased header for an autoRelease repo). The dependency updates themselves appear consistent between go.mod and go.sum, but the tools.go pattern must be corrected before merge.",
  "comments": [
    {
      "file": "tools.go",
      "line": 5,
      "severity": "critical",
      "message": "go-tools-versioning/no-tools-go-for-clis: tools.go contains CLI tool import `github.com/maxbrunsfeld/counterfeiter/v6`. Use tools.env + Makefile @version instead. See docs/go-tools-versioning-guide.md."
    },
    {
      "file": "CHANGELOG.md",
      "line": 1,
      "severity": "major",
      "message": "changelog/unreleased-entry-required: PR changes source but CHANGELOG.md has no '## Unreleased' bullet. In an autoRelease repo the release agent promotes '## Unreleased' post-merge; with none, no version ships. Add a conventional-prefixed bullet under '## Unreleased'. See docs/changelog-guide.md."
    }
  ],
  "concerns_addressed": [
    "security: gosec/vulnscan coverage not reviewed here — selector mode defers to CI; recommend confirming CI pipeline includes govulncheck and gosec",
    "correctness: go.mod and go.sum are consistent — dependency checksums align after refresh",
    "correctness: CHANGELOG.md accurately reflects dependency updates under v0.2.2, but ## Unreleased header is missing per autoRelease convention",
    "tests: precommit skipped in selector mode — CI covers lint+test; recommend confirming make precommit passes before merge"
  ]
}

[bborbe]

Merging with a documented waiver on the two review findings:

1. tools.go CRITICAL (counterfeiter import) — pre-existing; not introduced by this PR (diff touches only CHANGELOG.md/go.mod/go.sum). Repo-wide //go:build tools pattern → tracked as a separate tools.env migration task, out of scope for a dependency refresh.
2. CHANGELOG ## Unreleased MAJOR — not applicable to this repo's release flow: no in-repo autoRelease action (ci.yml runs tests only), and v0.2.2 is already tagged via updater. ## v0.2.2 is therefore correct; a ## Unreleased header would misrepresent already-released work.

CI green (test SUCCESS), make precommit clean (0 vulns). Merging via merge-commit to keep the pushed v0.2.2 tag reachable.