chore(deps): consolidate outstanding dependency updates for single-pass testing

[mrsheepuk]

Consolidates the outstanding dependency updates against develop into one change set so the full CI + E2E surface can be exercised once. The go_modules PRs all rewrite go.mod/go.sum/vendor/ and cannot be merged independently without conflicting; #1791 also subsumes #1789 and #1788 (ec2 v1.294.0 already requires aws-sdk-go-v2 v1.41.3 and smithy-go v1.24.2).

Supersedes: #1793, #1791, #1790, #1789, #1788, #1787, #1785, #1784, #1783, #1782.
Intentionally not included: #1752 (tablewriter v1.1.3) - it changes rendered tnctl table padding and fails pkg/cmd/tnctl/state/list_test.go, which overlaps the open CLI formatting work in #1562.

Dependency changes

Module	From	To	Driver
aws-sdk-go-v2/service/ec2	v1.285.0	v1.294.0	#1791
aws-sdk-go-v2	v1.41.1	v1.41.5	#1789, raised by s3 v1.97.3
aws/smithy-go	v1.24.1	v1.24.2	#1788
sigs.k8s.io/controller-runtime	v0.22.4	v0.23.3	#1790
go.opentelemetry.io/otel{,/metric,/trace}	v1.39.0	v1.44.0	#1782 + advisory
go.opentelemetry.io/otel{,/sdk/metric}	v1.39.0	v1.44.0	#1782 + advisory
golang.org/x/crypto	v0.48.0	v0.55.0	7 critical advisories
google.golang.org/grpc	v1.78.0	v1.83.2	4 advisories (1 critical)
golang.org/x/net	v0.50.0	v0.58.0	advisory
hashicorp/go-getter (direct)	v1.8.4	v1.8.6	advisory
go-jose/go-jose/v4	v4.1.3	v4.1.4	advisory
aws-sdk-go-v2/service/s3	v1.95.0	v1.97.3	advisory
aws-sdk-go-v2/aws/protocol/eventstream	v1.7.4	v1.7.8	advisory
go.mongodb.org/mongo-driver	v1.17.4	v1.17.7	advisory

Security targets are the minimum fixed versions, which keeps everything on the go1.25 toolchain (latest x/crypto/x/net/go-getter require go1.26). go-getter v1.8.6 requires go 1.25.8, so the go directive moves 1.25.0 -> 1.25.8 and the now-redundant toolchain pin is dropped (CI resolves go-version: "1.25" to 1.25.14). The otel bump goes to v1.44.0 rather than the v1.40.0 proposed in #1782, because 1.40.0 is still inside two open advisory ranges (otel <= 1.40.0, otel/sdk <= 1.42.0). Bumps pulled in transitively by these (grpc/cloud.google.com/envoy, golang.org/x/*, genproto) are included.

Code changes required

• controller-runtime 0.23 deprecations (make golangci-lint runs staticcheck: all, so these are fatal): the 7 validators and 3 defaulters move to admission.Validator[T]/Defaulter[T] with concrete resource types, and registrations move to admission.WithValidator/WithDefaulter. The now impossible expected a X, but got: Y test cases are dropped.
• mgr.GetEventRecorderFor is deprecated in favour of the events.k8s.io backed mgr.GetEventRecorder. That migration changes event RBAC and the 12 Eventf call sites, so it is deliberately deferred; the 8 call sites carry a scoped //nolint:staticcheck with a TODO. Behaviour unchanged.
• GitHub Actions majors: login-action v4, build-push-action v7.0.0, setup-buildx-action v4, upload-artifact v7, download-artifact v8.
• Alpine base image 3.23.3 -> 3.23.5 (Dockerfile.controller, Dockerfile.executor, Dockerfile.cli): both image jobs were failing on CVE-2026-31789 (openssl heap buffer overflow), reported CRITICAL against libcrypto3/libssl3 3.5.5-r0 with the fix in 3.5.6-r0. apk add ca-certificates does not upgrade it because the installed version already satisfies the dependency, so the base tag has to move; alpine:3.23.5 ships 3.5.7-r0.

Verification

• go build ./..., go vet ./... clean
• make test - all packages pass
• make golangci-lint - clean
• gofmt -l pkg cmd test - clean
• CI on this PR - all 9 checks pass, including the two image jobs and their trivy scans (the gobinary scan of bin/controller also reports 0 findings)
• Reproduced the CVE locally with the CI scan settings (trivy image --ignore-unfixed --severity CRITICAL): alpine:3.23.3 reports 2 CRITICAL, all three rebuilt images report 0
• E2E dispatched on this branch (cloud=aws, version=ci): https://github.com/appvia/terranetes-controller/actions/runs/35239861007 - the image build/upload/download jobs and the helm install, webhook registration, provider and configuration creation all pass, confirming the migrated generic webhooks serve correctly. The run then fails at the terraform plan step with BackoffLimitExceeded while the runner's own diagnostics S3 upload reports InvalidAccessKeyId - the E2E AWS credential is stale, not a regression. Last green develop E2E was 2026-01-22. Re-run after rotating the secret: GIT_BRANCH=chore/deps-consolidated make trigger-aws-e2e

Note: develop is currently missing 3 commits that are only on master (including the GHSA-26jv-m5j2-9xpp enableAutoApproval fix in #1794), so a master -> develop reconcile is still outstanding and this branch does not include that fix.

[mrsheepuk]

Verification status

CI on this PR: ci, linting, binaries, cli, formating, helm, dependencies all pass. controller-image and executor-image fail at the trivy "Verify Image" step, which is pre-existing - both jobs are also red on already-merged #1786 and #1796.

AWS E2E dispatched on this branch (cloud=aws, version=ci): https://github.com/appvia/terranetes-controller/actions/runs/35239861007

• controller-image / executor-image jobs: success - this exercises the bumped docker/setup-buildx-action@v4, docker/build-push-action@v7.0.0 and actions/upload-artifact@v7
• e2e job: Retrieve Controller Image / Retrieve Executor Image / Load images success - exercises actions/download-artifact@v8
• Helm install, CRDs, webhook registration (We should have the controller webhooks enabled, mutating webhook present), provider, configuration creation and plan job creation all pass, so the migrated admission.Validator[T]/Defaulter[T] webhooks are serving correctly
• The run then fails at We should see the terraform plan complete successfully: the terraform/executor Job hits BackoffLimitExceeded, and the workflow's own diagnostics S3 upload fails with InvalidAccessKeyId: The AWS Access Key Id you provided does not exist in our records

That InvalidAccessKeyId is raised by the runner's own S3 upload using E2E_AWS_ACCESS_KEY_ID/E2E_AWS_SECRET_ACCESS_KEY, i.e. the E2E AWS credential is stale rather than a regression in this change set. The last E2E run on develop was 2026-01-22 (success), and none have run since, so the AWS secret needs rotating before this branch can produce a full E2E pass. A re-run after rotation is a one-liner: GIT_BRANCH=chore/deps-consolidated make trigger-aws-e2e.