chore: update agents.md

[PeterSchafer]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Clarify dependency update in agents.md

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

---

Note

Low Risk
Documentation-only change to agent instructions; no runtime, build, or dependency behavior changes.

Overview
Adds a Handling go.sum and private modules subsection under Updating Go Dependencies in AGENTS.md.

The new text tells agents and contributors to refresh go.mod/go.sum only via go get, go mod tidy, or make tidy, and not to hand-edit go.sum because entries must stay lexicographically sorted. It documents using go mod tidy -e when private modules (e.g. ambient-canary) prevent a normal tidy, and gives a last-resort workflow for manual go.sum edits (insert in sorted order, then run sort -c go.sum).

^{Reviewed by Cursor Bugbot for commit 5a47a57. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 5 relevant code sections from 4 files (average relevance: 0.73) CONTRIBUTING.md (2 segments, lines 311-480) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) CLAUDE.md (lines 1-65) dangerfile.js (lines 1-111)

🤖 Repository instructions applied (from AGENTS.md)

[github-actions]

	Warnings
⚠️	Since the CLI is unifying on a standard and improved tooling, we're starting to migrate old-style imports and exports to ES6 ones. A file you've modified is using either module.exports or require(). If you can, please update them to ES6 import syntax and export syntax. Files found: AGENTS.md

Generated by 🚫 dangerJS against 5a47a57