Refresh controller and execd runtime dependencies - #5

Summary

• Refresh execd from Go 1.25.9 to the current patched Go 1.25.12 toolchain.
• Refresh golang.org/x/net, x/text, and compatible transitive x/* modules in execd and the Kubernetes controller.
• Pin the controller, execd, and Alpine build/runtime bases by multi-arch manifest digest.

This removes the ten distinct High-severity root causes found by the maintained-image preflight: eight fixed Go standard-library advisories plus the fixed x/net and x/text advisories. The initial execd report counted 28 findings because the same dependencies were embedded in the Linux binary, Windows helper, and supervisor.

Validation

• TMPDIR=/private/tmp/execd-test-tmp go test ./... in components/execd: passed. The explicit temp root avoids macOS's /var symlink, which execd's isolation tests correctly reject.
• make test in kubernetes: passed, including all 36 envtest-backed controller specs.
• Native arm64 controller and execd image builds: passed before the dependency refresh; the publication workflow rebuilds both architectures from this commit before signing.
• Pre-refresh local Trivy scans: 0 Critical for controller and execd. The refreshed versions address every reported High package version with a published fix.