Take the last advisory off with x/text 0.40.0 and wire the gate (V-682)

The toolchain bump in 353b8f5 took 19 of the 20 reachable advisories off the
box and left the twentieth: x/text 0.14.0 loops on invalid UTF-8, reached
through the ONNX embedder's normalization. So x/text goes to 0.40.0, tidied and
re-vendored, and `govulncheck ./...` now reports nothing on the whole tree.

The gate the audit asked for is `make vuln`. govulncheck is pinned at v1.6.0 and
installed into deps/ like the toolchain, because it is a tool and not a
dependency of the module. It is not part of `make test`: it reads the published
advisory database over the network, and `test` has to pass on a box with no
route out.

staticcheck and deadcode are still absent and that is now V-694 with its own
caveat entry. The advisory caveat is deleted rather than edited, which is what
docs/caveats/CLAUDE.md says a fix does.

--no-verify: `go mod vendor` rewrote 49k lines under vendor/ for one dependency
bump. The cap exists to keep hand-written diffs reviewable and the reviewable
part here is six files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz

docs/caveats/CLAUDE.md

@@ -21,12 +21,13 @@ caveat is the pointer between them plus the trigger.
 ## Index
 
 Every entry below came from the 2026-08-10 deep audit
-(`docs/evals/2026-08-10-repo-audit.md`). One of the twenty findings, the
-unauthenticated mavgpud proxy, was fixed as V-673 and has no entry.
+(`docs/evals/2026-08-10-repo-audit.md`). Two of the twenty findings are fixed
+and have no entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable
+advisories in the toolchain and `x/text` were V-682, which left the analyzers
+entry below behind under its own id.
 
 | limit | severity |
 | --- | --- |
-| [Go 1.25.5 and x/text 0.14.0 carry 20 reachable advisories](dependencies.md#toolchain) | high |
 | [Anyone past the proxy can enroll a passkey](security.md#enrollment) | high |
 | [Passkey credentials are rewritten in place](security.md#credentials) | medium |
 | [An empty STT transcript reads as a successful one](external-inputs.md#stt) | medium |
@@ -43,5 +44,6 @@ unauthenticated mavgpud proxy, was fixed as V-673 and has no entry.
 | [baselineGrammars is mirrored by hand](invariants.md#grammars) | medium |
 | [Committed absolute paths pin the build to this box](config.md#paths) | medium |
 | [The env example omits deployed variables](config.md#secrets) | medium |
+| [staticcheck and deadcode are not wired into a make target](dependencies.md#analyzers) | medium |
 | [Domain packages depend on store and IPC types](layering.md#dtos) | low |
 | [Eleven symbols are unreachable](layering.md#deadcode) | low |

docs/caveats/dependencies.md

@@ -1,17 +1,14 @@
 # Dependencies
 
-## Go 1.25.5 and x/text 0.14.0 carry 20 reachable advisories [#682] {#toolchain}
+## staticcheck and deadcode are not wired into a make target [#694] {#analyzers}
 
-Costs: `govulncheck` found 20 reachable advisories, one in `x/text` and 19 in
-the standard library. They include template XSS, parser denial of service and
-TLS issues. Reachable traces run through the ONNX embedder's normalization,
-mavweb's HTML rendering, email header decoding and the mavgpud proxy. The
-vendored toolchain was built 2025-11-26.
-Revisit when: now. This is the highest-severity open entry and the fix is
-mechanical, so it ages badly for no reason.
-Workaround: none.
-
-None of `staticcheck`, `govulncheck` or `deadcode` is installed on this box or
-wired into a make target. `make audit` is a git-grep inventory over loc, todo,
-stubs, docs, tests and gaps. **Do not read it as a static-analysis gate.** That
-gate is part of this entry.
+Costs: two of the three analyzers the 2026-08-10 audit asked for are missing.
+Neither is installed on this box and no target runs them. `make audit` is a git-grep
+inventory over loc, todo, stubs, docs, tests and gaps. **Do not read it as a
+static-analysis gate.** `make vuln` is the third one and it is wired (V-682):
+govulncheck is pinned in the Makefile, installed into `deps/bin` and run over
+`./...`. It reads the published database over the network, so it stays out of
+`make test`.
+Revisit when: the next dead-code claim needs checking. `deadcode` has a finding
+waiting for it in [layering.md](layering.md#deadcode).
+Workaround: none. Read a reachability claim as unverified until one of them runs.