build(deps): update golden test helper to v0.1.0

[steipete]

Replace the transitive golden-test helper's pseudo-version with its v0.1.0 release. The release is past the repository's three-day cooldown, and its module metadata has the same dependency requirements.

Validated with make check on the merged analytics changes: 85.7% coverage, lint/vulnerability checks, CLI smoke, docs, release-script tests, and six-platform snapshot builds. Independent Codex review found no actionable P0–P2 issues.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 29, 2026, 11:10 PM ET / September 30, 2026, 03:10 UTC.

ClawSweeper review

What this changes

The branch replaces Gitcrawl’s transitive golden test helper pseudo-version with v0.1.0, updates its Go checksums, and records the change in the changelog.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: current main still uses the pseudo-version, while the proposed release tag is verified and points to the same upstream source tree. The review found no actionable defect.

Priority: P3
Reviewed head: 56588fc05df6a5ffd613b499d2789705eef13a26

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with a verified upstream tag, identical source tree, and no identified correctness or security issue.
Proof confidence	🌊 off-meta tidepool	Not applicable: The changed production owner is Go dependency resolution, and the PR body reports make check on the merged analytics branch. Repository admin permission makes the external-contributor setup-proof gate inapplicable; the verified upstream source tree is unchanged, and no stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The changed production owner is Go dependency resolution, and the PR body reports make check on the merged analytics branch. Repository admin permission makes the external-contributor setup-proof gate inapplicable; the verified upstream source tree is unchanged, and no stored-data contract changes.
Evidence reviewed	9 items	Proposed module version: The PR changes the indirect golden helper requirement to v0.1.0. Current main still needs the change: Current main retains the pseudo-version, and the GitHub main branch still points to this base commit. Upstream source equivalence: The old pseudo-version commit and the commit tagged exp/golden/v0.1.0 have the identical Git tree 668a321bf6309d7d846c121a0c23274b2b84948a; the comparison reports no changed files.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl is a Go CLI. Its module manifest selects dependencies for builds and tests, and this change updates one transitive test helper in that dependency set.

flowchart LR
 A[Go module manifest] --> B[Dependency resolution]
 B --> C[Golden test helper]
 C --> D[Go builds and tests]
 D --> E[CI results]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Upstream source delta	0 changed files	The release tag and prior pseudo-version resolve to the same upstream Git tree.

Technical review

Best possible solution:

Use the verified v0.1.0 tag with matching module checksums as Gitcrawl’s dependency baseline.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR refreshes a dependency version rather than reporting a broken behavior; the relevant verification is the upstream tag and module comparison.

Is this the best way to solve the issue?

Yes: pinning the verified release is a narrow update, and the tagged upstream code and module requirements match the previous commit.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 84ed753d157f.

Labels

Label changes:

• add P3: This is a small dependency version refresh with no upstream source change or identified user-facing regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The changed production owner is Go dependency resolution, and the PR body reports make check on the merged analytics branch. Repository admin permission makes the external-contributor setup-proof gate inapplicable; the verified upstream source tree is unchanged, and no stored-data contract changes.

Label justifications:

• P3: This is a small dependency version refresh with no upstream source change or identified user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The changed production owner is Go dependency resolution, and the PR body reports make check on the merged analytics branch. Repository admin permission makes the external-contributor setup-proof gate inapplicable; the verified upstream source tree is unchanged, and no stored-data contract changes.

Evidence

What I checked:

• Proposed module version: The PR changes the indirect golden helper requirement to v0.1.0. (go.mod:25, 56588fc05df6)
• Current main still needs the change: Current main retains the pseudo-version, and the GitHub main branch still points to this base commit. (go.mod:25, 84ed753d157f)
• Upstream source equivalence: The old pseudo-version commit and the commit tagged exp/golden/v0.1.0 have the identical Git tree 668a321bf6309d7d846c121a0c23274b2b84948a; the comparison reports no changed files. (d676b019604b)
• Upstream module requirements: The tagged module file declares Go 1.24.0 and go-udiff v0.4.1, matching the old commit’s module file. (exp/golden/go.mod:1, d676b019604b)
• Release provenance: The verified annotated exp/golden/v0.1.0 tag was dated September 24, 2026, more than three days before this PR. (d676b019604b)
• Dependency cooldown: The repository configures a three-day cooldown for Go module updates. (.github/dependabot.yml:8, 84ed753d157f)

Likely related people:

• Peter Steinberger: Raw commit d8d19ef adds go.mod:13 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: d8d19effd37d; files: go.mod)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.