CP-46909: Batch Dependabot dependency updates

[amfelso]

Batches 18 of the open Dependabot dependency PRs onto one branch.

Root-module bumps fail format and generate, because format tidies all three modules and a root bump also rewrites tests/go.sum, which Dependabot doesn't commit. One tidy commit fixes all of them.

• c6c0ae14 — Go module bumps across /, /tests and /.tools, then make format generate
• ac762dfb — docker/setup-buildx-action → v4.3.0, renovatebot/github-action → v46.2.2
• 962c8c65 — distroless/static-debian12:debug digest → e60a053

Supersedes #952, #953, #958, #959, #960, #962, #964, #966, #968, #970, #971, #973, #974, #976, #977, #978, #979, #981.

Left for separate PRs: #972, #969, #967, #957, #954 fail for reasons unrelated to tidiness. #975 and #980 are the /tests halves of #972 and #969, so they move with them.

Validation

make build, make test (65 packages, 0 failures) and make generate all clean locally. lint and analyze don't run on macOS here, so CI covers those.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR batches dependency updates across the runtime, test, and tooling Go modules, updates two GitHub Actions, and refreshes the distroless image digest.

• Updates runtime and transitive Go dependencies, including Kubernetes, MinIO, Parquet, and networking packages.
• Updates testcontainers and Kubernetes dependencies in the test module.
• Updates Helm and staticcheck in the tooling module.
• Updates Docker Buildx, Renovate, and the distroless certificate-stage image.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code defect identified.

The dependency manifests and checksums are updated together, workflow and image changes retain their existing execution models, and the investigated compatibility and security leads did not establish a reachable failure introduced by this PR.

Important Files Changed

Filename	Overview
go.mod	Updates runtime dependencies and associated transitive versions; no concrete compatibility failure was established.
tests/go.mod	Updates testcontainers, Kubernetes test dependencies, and transitives consistently with the regenerated checksum file.
.tools/go.mod	Updates Helm and staticcheck tooling dependencies; no concrete Makefile or CI invocation incompatibility was found.
.github/workflows/docker-build.yml	Updates both Docker Buildx references to the same immutable v4.3.0 commit.
.github/workflows/renovate.yml	Updates Renovate from one mutable release tag to another without changing workflow permissions or credential flow.
docker/Dockerfile	Refreshes the immutable distroless debug image digest used as the certificate source stage.

_{Reviews (1): Last reviewed commit: "CP-46909: Bump distroless base image dig..." | Re-trigger Greptile}

[josephbarnett]

Fix the builds and I bet this will all work