fix(deps): bump whatsmeow to unblock WhatsApp "client outdated (405)"

[grrowl]

📝 Description

WhatsApp now rejects the client version advertised by the currently pinned go.mau.fi/whatsmeow v0.0.0-20260219150138-7ae702b1eed4. The socket connects and is dropped ~5s later with Client outdated (405), and no reconnect is attempted — so the native WhatsApp channel stays dead rather than flapping, with nothing obviously wrong in the config.

This bumps whatsmeow to v0.0.0-20260730092514-662ad1dc6900, which is both @latest and the pin carried by the last known-good binary on my host.

That bump forces a matching mautrix bump, which is the only reason this diff is larger than a one-line version change:

• whatsmeow requires go.mau.fi/util v0.9.12-0.20260717235539, a pre-release snapshot in which dbutil.UpgradeTable lost Register/RegisterFS.
• Minimal version selection picks that snapshot over the v0.9.11 that mautrix v0.27.0 asks for, so crypto/sql_store_upgrade and sqlstatestore stop compiling.
• No released mautrix is compatible — v0.29.0, the newest release, still requires util v0.9.11 — so mautrix moves to main (v0.29.1-0.20260803184111-a4cf7de248e9), which tracks a util snapshot newer than whatsmeow's and restores the build.

Tracking a mautrix main snapshot is the part most worth a maintainer's opinion. It's the only combination I found that builds; if you'd rather wait for a mautrix release that pins util ≥ v0.9.12, this PR is effectively blocked on that upstream release rather than on anything in this repo.

The remaining go.sum/go.mod churn (golang.org/x/*, mattn/go-sqlite3, tidwall/gjson, coder/websocket, libsignal, petermattis/goid) is transitive fallout from those two bumps, not deliberate.

No source changes — this is go.mod + go.sum only.

🗣️ Type of Change

• 🐞 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 📖 Documentation update
• ⚡ Code refactoring (no functional changes, no api changes)

🤖 AI Code Generation

• 🤖 Fully AI-generated (100% AI, 0% Human)
• 🛠️ Mostly AI-generated (AI draft, Human verified/modified)
• 👨‍💻 Mostly Human-written (Human lead, AI assisted or none)

The dependency resolution above was worked out with AI assistance and verified by me on a live WhatsApp deployment — the channel was dead before the bump and has been connected since.

🔗 Related Issue

None open that I could find. Filing this directly since the symptom is a hard outage for anyone on the native WhatsApp channel, and the cause is entirely in the pinned dependency.

📚 Technical Context (Skip for Docs)

• Reference URL:
  • whatsmeow: https://github.com/tulir/whatsmeow
  • mautrix-go main: https://github.com/mautrix/go
  • dbutil.UpgradeTable API change in go.mau.fi/util: https://github.com/mautrix/go-util
• Reasoning: WhatsApp enforces a minimum client version server-side. The pinned whatsmeow advertises a version that is now below that floor, so the handshake is rejected with 405 regardless of local configuration. The only fix is to advertise a newer version, i.e. bump whatsmeow. Everything else in the diff follows from Go's minimal version selection.

🧪 Test Environment

• Hardware: Raspberry Pi
• OS: Debian 12 (linux/arm64)
• Model/Provider: OpenAI-compatible endpoint (local)
• Channels: WhatsApp (whatsapp_native build tag)

📸 Evidence (Optional)

Click to view Logs/Screenshots

Before the bump — connects, then dropped ~5s later, no reconnect:

Client outdated (405) connect failure

After the bump the channel connects and stays up.

Verified locally (darwin/arm64, Go 1.25):

• make vet, make deps and make lint-docs pass on this branch.
• make lint reports 9 issues (8 govet "Constant reflect.Ptr should be inlined", 1 prealloc), all in files this PR does not touch — pkg/providers/, web/backend/api/config.go, pkg/agent/pipeline_llm.go. This PR contains no Go source changes at all, only go.mod/go.sum, so none of them can originate here; they look like an artifact of a locally-installed golangci-lint newer than the version CI pins.
• make test passes except for three pre-existing failures in pkg/tools — TestShellTool_RelativePathWithSlashAllowed, TestShellTool_DevNullAllowed and TestShellTool_FileURISandboxing. These are macOS-only (the guard resolves /var/folders/... through the /var → /private/var symlink and treats the temp workspace as outside the working dir) and are not caused by this change: I ran the same three tests on an unmodified origin/main worktree and they fail identically there.
• The whatsapp_native capability tests pass unchanged against the newer whatsmeow, so the 5-month jump needed no adaptation on our side.

☑️ Checklist

• My code/docs follow the style of this project.
• I have performed a self-review of my own changes.
• I have updated the documentation accordingly. (No docs affected — dependency-only change.)

[CLAassistant]

All committers have signed the CLA.