[onedr0p]

Implements the standing note in AGENTS.md's Security section:

• Pins govulncheck in .mise/config.toml via the go backend (go:golang.org/x/vuln/cmd/govulncheck 1.6.0) and adds a vulncheck task running govulncheck ./....
• Runs it in CI as a Go Vulncheck job wired into the Build Success fan-in, so a new advisory blocks the merge queue.
• Updates AGENTS.md's Security section to match.
• Upgrades golang.org/x/text v0.37.0 → v0.39.0: the new gate immediately flagged GO-2026-5970 as reachable via the k8s dynamic client (internal/k8s/fetcher.go → norm.Form.*). Unit tests pass after the bump.

[greptile-apps]

Greptile Summary

This PR adds a pinned govulncheck task and CI job, includes that job in the Build Success fan-in, and updates the documented security workflow.

• Pins govulncheck 1.6.0 through Mise.
• Runs vulnerability analysis in CI and locally through mise run vulncheck.
• Upgrades golang.org/x/text from v0.37.0 to v0.39.0.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/ci.yaml	Adds the Go Vulncheck job using established workflow conditions and correctly includes it in the aggregate status job.
.mise/config.toml	Pins govulncheck and exposes a straightforward repository-wide vulnerability scan task.
.mise/mise.lock	Records the configured govulncheck version and Go backend.
AGENTS.md	Updates security guidance to reflect the newly configured local and CI vulnerability checks.
go.mod	Upgrades golang.org/x/text to v0.39.0 without changing the pre-existing golang.org/x/net version.
go.sum	Updates checksums consistently for the golang.org/x/text dependency bump.

_{Reviews (2): Last reviewed commit: "docs(agents): go.mod and mise go version..." | Re-trigger Greptile}