chore(deps): update go dependencies (#802)

## Summary
- Update all Go dependencies to latest compatible versions
- Notable updates: connectrpc v1.19.1, cobra v1.10.2, protobuf v1.36.11, otel v1.40.0, actionlint v1.7.11
- docker/docker kept at v25 (v28+ has breaking module restructuring)
- Fix govulncheck issues: update go-git v5.16.2 → v5.16.5 (GO-2026-4473), containerd v1.7.13 → v1.7.29 (GO-2025-4108, GO-2025-4100, GO-2025-3528)
- Remove unnecessary go-git replace directive
- Add `make tidy` and `make tidy-check` Makefile targets
- Clarify `distribution/reference` replace directive comment (needed because `docker/distribution@v2.8.3` uses `reference.SplitHostname` removed in v0.6.0)

## Test plan
- [x] `go build ./...` passes
- [x] `go test ./...` passes
- [x] `govulncheck ./...` passes

Reviewed-on: https://gitea.com/gitea/act_runner/pulls/802
Reviewed-by: ChristopherHX <christopherhx@noreply.gitea.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>

Makefile

@@ -111,6 +111,19 @@ deps-tools: ## install tool dependencies
 security-check: deps-tools
 	GOEXPERIMENT= $(GO) run $(GOVULNCHECK_PACKAGE) -show color ./...
 
+.PHONY: tidy
+tidy:
+	$(GO) mod tidy
+
+.PHONY: tidy-check
+tidy-check: tidy
+	@diff=$$(git diff -- go.mod go.sum); \
+	if [ -n "$$diff" ]; then \
+		echo "Please run 'make tidy' and commit the result:"; \
+		echo "$${diff}"; \
+		exit 1; \
+	fi
+
 test: fmt-check security-check
 	@$(GO) test -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1