chore(deps): update project dependencies

[cpcloud]

What changed

• Updated the full Go module graph together, including the abandoned SQLite, validator, x/sys, phonenumbers, and mcp-go updates.
• Refreshed the Nix flake input and Go vendor hash so the packaged build uses the same dependency set.
• Updated SHA-pinned GitHub Actions and supplied the cache keys required by Blacksmith builder v2.
• Migrated the Biome rule configuration to its current schema.

Why

The separate dependency PRs stopped receiving Renovate updates after the vendor-hash workflow edited their branches. Updating the graph as one unit avoids combining individually stale lockfile states and lets API, lint, packaging, platform, and vulnerability compatibility be checked together.

Review notes

• Harden Runner is intentionally pinned to v2.20.0. Version 2.20.1 implicitly permits single-label domains in block mode and does not expose a compatibility input, so taking it would weaken the existing egress policy.
• No new Go module paths were introduced. The updated dependency sources and release changes were audited, including the SQLite/libc fixes.
• The Blacksmith action update requires cache-key; each workflow uses the Dockerfile it builds.
• The nixpkgs update builds prek's Rust vendor tree during Pre-commit, so only that job's block-mode allowlist adds static.crates.io:443.
• Homebrew redirects macOS bottle downloads to GitHub's package-content host, so only the build/test job's block-mode allowlist adds pkg-containers.githubusercontent.com:443.

Supersedes #1021, #1018, #1009, #1004, and #1000.