chore(deps): patch Dependabot alerts; migrate kubewatch argo-cd v2 -> v3

[prkhrkat]

Fixes devtron-labs/devtron#6839

Rebased onto main after #395 landed, so this is only the remaining delta.

Dependency bumps

Across every module: google.golang.org/grpc 1.79.3 / 1.80.0 → 1.82.1

module	change
chart-sync	oras-go 2.6.1 → 2.6.2
common-lib	oras-go 2.6.1 → 2.6.2, k8s.io/kubernetes 1.33.4 → 1.33.6
kubelink	oras-go 2.6.1 → 2.6.2, k8s.io/kubernetes 1.33.4 → 1.33.6
git-sensor	go-git/v5 5.19.1 → 5.19.2
lens	go-pg/pg/v10 10.14.0 → 10.15.0
kubewatch	argo-cd/v2 2.14.20 → argo-cd/v3 3.4.7, argo-workflows/v3 3.7.14 → 3.7.15, oras-go 2.6.1 → 2.6.2, go-git/v5 5.19.1 → 5.19.2, k8s.io 0.33.3 → 0.34.9, k8s.io/kubernetes 1.33.4 → 1.34.10

kubewatch → argo-cd v3

The argo-cd/v2 advisory has no patched release — migrating is the only way
it closes. Only three files import argo-cd, so it was an import-path rewrite
with no API fallout.

gitops-engine moved in-repo in v3.4, to
github.com/argoproj/argo-cd/gitops-engine. Argo CD's own go.mod resolves it
with a local replace ./gitops-engine, which does not apply to consumers, and
the version it requires does not exist at the new path — go mod tidy fails
outright. Pinned via replace to the v3.4.7 tag revision.

Dropped the filepath-securejoin pin ⚠️

main pins filepath-securejoin => v0.3.6, and its comment says why: argo-cd/v2
calls the old MkdirAll(root, path, int(mode)) signature. argo-cd v3.4.7
requires v0.6.1, so after this migration that replace was holding the module
below what argo-cd needs. Removed.

Because the breakage it guarded lives in secure_mkdir_linux.go, a host-only
build would not catch a regression here — so every module was verified with
GOOS=linux as well.

Build fix

kubewatch's go directive moved 1.25.7 → 1.26.0 (gitops-engine requires
go 1.26.0), so its builder image goes golang:1.25-alpine → golang:1.26-alpine.
Note there is no golang:1.26-alpine3.21 — the alpine3.21 variant was dropped
for Go 1.26 (registry 404s), so the pinned form could not have been carried over
regardless. Build stage only; the runtime stage stays on alpine:3.21.2 and
kubewatch builds CGO_ENABLED=0, so the binary is static.

Still open — no upstream fix exists

• go-pg/pg v8
• quay/claircore
• docker/docker — Dependabot names 29.3.1, but docker publishes no v29 tag to
  the Go proxy (it uses +incompatible; max is v28.5.2)

helm.sh/helm/v3 3.20.2 is already in chart-sync via #395. common-lib and
kubelink stay on 3.18.6 — 3.20.2 requires k8s 0.35.1 and both are on 0.33; no
Argo CD release builds against k8s 0.35 (3.4.x pins 0.34, 3.5.x pins 0.36), so
that is separate work.

Verification

• Vendor-mode build of all nine modules, for both darwin and GOOS=linux
• make build green end to end, wire codegen included
• Exercised the resulting client stack against a live k8s 1.35.6 / Argo CD
  3.4.6 cluster: discovery negotiated, core/v1 + apps/v1 + batch/v1 +
  networking/v1 + rbac/v1 all listed, and an Application built from the v3.4.7 Go
  types was accepted by the real CRD via server-side dry-run and decoded back
  intact (automated=true prune=true). Nothing persisted.

The third commit is just env_gen.{json,md} regenerated by make build — these
were already stale on main relative to its own common-lib. Split out so it can
be dropped independently.

🤖 Generated with Claude Code

[github-actions]

Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n

[github-actions]

Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n

[github-actions]

Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n

[github-actions]

Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n