go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5, golang.org/x/net v0.57.0 -> v0.58.0.
go mod tidy moves golang.org/x/image to the direct block; 57ae942 imports it for PNG badge encoding.
govulncheck is clean: 0 called vulnerabilities. The one module-graph finding, GO-2026-5932 on golang.org/x/crypto/openpgp, is unreachable — internal/sig uses ProtonMail/go-crypto and x/crypto is in the graph for ssh and term.
Full suite green locally.
Closes #60