update(deps): bump hugot v0.7.0 to v0.7.2 and mcp go-sdk v1.5.0 to v1.6.0

[laradji]

Parent: #156
Depends on: none
Related: audit §5.2 finding 2, §8 action item 24

Why

Two outdated direct deps surfaced by go list -m -u all during the
audit:

github.com/knights-analytics/hugot         v0.7.0  → v0.7.2 (patch +2)
github.com/modelcontextprotocol/go-sdk     v1.5.0  → v1.6.0 (minor +1)

Patch bumps for hugot are likely bug fixes; the go-sdk minor bump
may include feature changes affecting cmd/deadzone/server.go's MCP
wiring.

Decision (locked 2026-04-30)

• Bump both deps in separate commits within this PR so each can
  be reverted independently if it regresses.
• Audit go-sdk minor bump's CHANGELOG / release notes for breaking
  changes; surface them in the PR body (do not silently absorb).
• Do NOT bulk-bump indirect deps in this PR. go mod tidy will pick
  up necessary indirect changes; anything else stays out.
• Leave gomlx/* pseudo-version pins alone — that's the deferred
  pushback on audit finding Stack decision: Go + libSQL + FTS5 (no ML for MVP) #4.

Acceptance criteria

• First commit: update(deps): bump hugot v0.7.0 → v0.7.2
  - go.mod line for github.com/knights-analytics/hugot updated.
  - go.sum regenerated via mise exec -- go mod tidy -tags ORT.
  - just test -short passes.
  - mise exec -- go vet -tags ORT ./... passes.
• Second commit: update(deps): bump mcp go-sdk v1.5.0 → v1.6.0
  - go.mod line for
  github.com/modelcontextprotocol/go-sdk updated.
  - go.sum regenerated.
  - PR body includes a "go-sdk v1.5 → v1.6 changelog audit"
  section listing every breaking change in the upstream
  release notes and whether deadzone's MCP wiring
  (cmd/deadzone/server.go) is affected.
  - If any wiring change is needed to compile / behave correctly,
  include it in the same commit with a clear inline comment.
  - just test -short passes including
  cmd/deadzone/server_test.go.
  - mise exec -- go vet -tags ORT ./... passes.
• No gomlx/* pin changes (deferred to a separate issue per
  pushback on audit finding Stack decision: Go + libSQL + FTS5 (no ML for MVP) #4).
• No other direct or indirect dep is bumped beyond what
  go mod tidy produces as a side effect.

Implementation sketch

# Commit 1
mise exec -- go get github.com/knights-analytics/hugot@v0.7.2
mise exec -- go mod tidy -tags ORT
just test
git add go.mod go.sum
git commit -m "update(deps): bump hugot v0.7.0 → v0.7.2"

# Commit 2
mise exec -- go get github.com/modelcontextprotocol/go-sdk@v1.6.0
mise exec -- go mod tidy -tags ORT
just test
# Audit changelog and adapt cmd/deadzone/server.go if needed.
git add go.mod go.sum [cmd/deadzone/server.go]
git commit -m "update(deps): bump mcp go-sdk v1.5.0 → v1.6.0"

PR body section:

## go-sdk v1.5 → v1.6 changelog audit

Upstream release: https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.6.0

Breaking changes:
- (list each one)

deadzone impact:
- cmd/deadzone/server.go:LINE — affected/unaffected (reasoning)
- cmd/deadzone/server_test.go:LINE — affected/unaffected

Test commands

• mise exec -- go test -tags ORT -short ./...
• mise exec -- go vet -tags ORT ./...
• just build — confirm CGO link still works.
• Manual MCP smoke: just serve then a probe with mcp CLI to
  verify the wiring still responds (optional but useful for the
  go-sdk bump).

Out of scope

• Bumping gomlx/* indirect deps (deferred pushback issue, not yet
  filed).
• Bulk indirect-dep upgrades (go get -u ./... style).
• Deprecation handling for golang/protobuf — that's a transitive
  upstream concern.
• Bumping tursogo (already latest at v0.5.3 per audit).

[laradji]

Le bump hugot v0.7.0 → v0.7.2 résout aussi audit finding #4 (gomlx pseudo-version pins) — vérifié via les go.mod upstream :

hugot v0.7.0 (état actuel) :

github.com/gomlx/go-huggingface v0.3.5-0.20260327162928-af20e4f3e7b5
github.com/gomlx/gomlx           v0.27.2
github.com/gomlx/onnx-gomlx      v0.4.2-0.20260327164137-4e2832549fc1

hugot v0.7.2 (cible du bump) :

github.com/gomlx/go-huggingface v0.3.5      ← STABLE
github.com/gomlx/gomlx           v0.27.3
github.com/gomlx/onnx-gomlx      v0.4.2      ← STABLE

Les deux pseudo-versions disparaissent automatiquement via MVS dès qu'on monte sur hugot 0.7.2. Pas d'action supplémentaire dans cette PR — go mod tidy après le bump reflètera les nouvelles versions stables dans le // indirect block de notre go.mod.

À ajouter à l'AC de cette issue :

• go.mod post-bump confirme github.com/gomlx/go-huggingface v0.3.5 et github.com/gomlx/onnx-gomlx v0.4.2 (sans suffixe pseudo-version) dans le bloc // indirect. Si l'un des deux reste pseudo-versionné, investiguer (autre dep transitif qui les pin différemment) avant de merger.