chore: refresh runtime dependencies

[steipete]

Summary

• update the supported Go toolchain and terminal/system modules
• update Playwright, Node, and npm used by browser-backed and Docker flows
• refresh cached Chrome cookie tooling and enforce audited transitive overrides
• verify the installed cookie dependency tree before certifying its cache

Why

The repository dependency backstop found supported stable updates plus vulnerable install-time transitives in the Chrome cookie helper. Existing caches also needed explicit invalidation so the security overrides are guaranteed to take effect.

Validation

• go test ./... (76.7% statement coverage)
• go test ./... -race
• go vet ./...
• golangci-lint run (0 issues)
• govulncheck ./... (no vulnerabilities)
• release-target cross-builds: darwin/linux/windows on amd64/arm64
• Docker build and smoke proof with Node 24.18.0, npm 12.0.1, and Playwright browser fetch
• runtime Chrome cookie dependency install followed by npm audit --omit=dev (0 vulnerabilities)
• AutoReview: no accepted/actionable findings remain
• Public Model Identifier Gate: PASS for the exact remote head and built artifacts

Risk

Medium: runtime/toolchain upgrades and security-sensitive cache refresh. Mitigated by unit/race/lint/security checks, six-platform builds, real Docker/browser behavior, dependency-tree verification, and structured review.