[xhdnoah]

Summary

Update dependencies used by plugin_daemon and plugin_daemon_local to address:

• CVE-2026-111497: github.com/andybalholm/brotli v1.1.1 → v1.2.7 (Go advisory GHSA-c9gr-gmg4-2vqv).
• CVE-2026-78661: golang.org/x/net v0.60.0 → v0.62.0.
• CVE-2026-116591: github.com/klauspost/compress v1.18.7 → v1.20.2.

Includes the x/crypto, x/sys, x/text, x/sync and x/tools updates required by the new module graph. Regenerate go.sum with go mod tidy.

Validation

• go mod verify: passed.
• All cmd, internal and pkg test packages compile after generating test signing keys using the CI setup step.
• Tests for github.com/andybalholm/brotli, github.com/klauspost/compress/zstd and golang.org/x/net/html: passed.
• Full repository test run did not pass locally: missing generated signing key on the initial run and unavailable Redis/CI services. Full runtime validation remains with CI.
• Images have not been rebuilt or rescanned.