#212 Bump golang.org/x/sys and golang.org/x/text past their advisories

Clears the three open code-scanning alerts on go.mod:

• Trivy #89 — CVE-2026-56852 in golang.org/x/text v0.34.0 (fixed in 0.39.0)
• Trivy #88 — CVE-2026-39824 in golang.org/x/sys v0.41.0 (fixed in 0.44.0)
• Scorecard #79 — Vulnerabilities: GO-2026-5024 (x/sys) and GO-2026-5970 (x/text)

Both modules are indirect, and govulncheck ./... under go1.26.6 (the declared toolchain) reports neither as reachable from this code — GO-2026-5024 is the Windows-only NewNTUnicodeString overflow. This is a scanner-clearing bump, not a fix for an exploitable path. Taken to the current releases (x/sys v0.48.0, x/text v0.42.0); x/sync moved with them through go mod tidy.

make check passes and govulncheck ./... is clean.

---

Summary by cubic

Bumps indirect golang.org/x/sys and golang.org/x/text past their advisories, clearing the three open code-scanning alerts on go.mod. govulncheck reports none of these are reachable from this code, so this is a scanner-clearing bump, not a fix for an exploitable path.

• x/sys goes from v0.41.0 to v0.48.0, x/text from v0.34.0 to v0.42.0.
• x/sync moves to v0.23.0 via go mod tidy.
• make check passes and govulncheck ./... is clean.