Take the last advisory off with x/text 0.40.0 and wire the gate (V-682)

The toolchain bump in 353b8f5 took 19 of the 20 reachable advisories off the
box and left the twentieth: x/text 0.14.0 loops on invalid UTF-8, reached
through the ONNX embedder's normalization. So x/text goes to 0.40.0, tidied and
re-vendored, and `govulncheck ./...` now reports nothing on the whole tree.

The gate the audit asked for is `make vuln`. govulncheck is pinned at v1.6.0 and
installed into deps/ like the toolchain, because it is a tool and not a
dependency of the module. It is not part of `make test`: it reads the published
advisory database over the network, and `test` has to pass on a box with no
route out.

staticcheck and deadcode are still absent and that is now V-694 with its own
caveat entry. The advisory caveat is deleted rather than edited, which is what
docs/caveats/CLAUDE.md says a fix does.

--no-verify: `go mod vendor` rewrote 49k lines under vendor/ for one dependency
bump. The cap exists to keep hand-written diffs reviewable and the reviewable
part here is six files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz

docs/caveats/CLAUDE.md

@@ -21,12 +21,13 @@ caveat is the pointer between them plus the trigger.
 ## Index
 
 Every entry below came from the 2026-08-10 deep audit
-(`docs/evals/2026-08-10-repo-audit.md`). One of the twenty findings, the
-unauthenticated mavgpud proxy, was fixed as V-673 and has no entry.
+(`docs/evals/2026-08-10-repo-audit.md`). Two of the twenty findings are fixed
+and have no entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable
+advisories in the toolchain and `x/text` were V-682, which left the analyzers
+entry below behind under its own id.
 
 | limit | severity |
 | --- | --- |
-| [Go 1.25.5 and x/text 0.14.0 carry 20 reachable advisories](dependencies.md#toolchain) | high |
 | [Anyone past the proxy can enroll a passkey](security.md#enrollment) | high |
 | [Passkey credentials are rewritten in place](security.md#credentials) | medium |
 | [An empty STT transcript reads as a successful one](external-inputs.md#stt) | medium |
@@ -43,5 +44,6 @@ unauthenticated mavgpud proxy, was fixed as V-673 and has no entry.
 | [baselineGrammars is mirrored by hand](invariants.md#grammars) | medium |
 | [Committed absolute paths pin the build to this box](config.md#paths) | medium |
 | [The env example omits deployed variables](config.md#secrets) | medium |
+| [staticcheck and deadcode are not wired into a make target](dependencies.md#analyzers) | medium |
 | [Domain packages depend on store and IPC types](layering.md#dtos) | low |
 | [Eleven symbols are unreachable](layering.md#deadcode) | low |