fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) (#1481)

## Problem

The **Build, Lint, and Validate** CI job is failing on every open PR
(#1480, #1474, #1449) and on `main`. The failing step is `govulncheck`:

```
Vulnerability #1: GO-2026-5970
    Infinite loop on invalid input in golang.org/x/text
    Found in: golang.org/x/text@v0.38.0
    Fixed in: golang.org/x/text@v0.39.0
```

This is **not** caused by any of those PRs' changes —
`govulncheck-action` fetches the live vulnerability database at runtime,
so when GO-2026-5970 was published, every branch based on the current
`main` started failing. The vulnerable symbol is reachable via:

- `auth.DefaultHTTPKeyFetcher.FetchKey` → `http.Client.Do`
- `database.NewTestDB` → `pgx.Connect`

so the scan exits with code 3.

## Fix

Bump the (indirect) `golang.org/x/text` dependency from `v0.38.0` to the
fixed `v0.39.0` and `go mod tidy`.

## Verification

- `govulncheck ./...` no longer reports GO-2026-5970 (confirmed
locally).
- `go build ./...` passes.

## Note

The `deploy/` module pins `golang.org/x/text@v0.37.0`, which is also <
v0.39.0. It is a separate module and is **not** scanned by this CI job
(govulncheck runs `./...` in the root module only), so it does not block
CI. Worth a follow-up bump for hygiene, but out of scope here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

go.mod

@@ -75,7 +75,7 @@ require (
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.21.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.287.1 // indirect
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect