fix(deps): bump golang.org/x/text to v0.39.0 (CVE-2026-56852)

[bborbe]

Fleet security update. golang.org/x/text v0.38.0 -> v0.39.0 (CVE-2026-56852). CHANGELOG under ## Unreleased; release agent versions on merge; no tag.

[ben-s-pull-request-reviewer]

Step 5: Consolidated Report

All changes look correct:

1. go.mod: golang.org/x/text v0.38.0 → v0.39.0 ✓
2. go.sum: Both h1 and go.mod entries updated to v0.39.0 with correct checksums ✓
3. CHANGELOG.md: Unreleased section added with CVE reference ✓

Step 7: Manual Review - Complete. No issues found.

No worktree cleanup needed (we're already in a worktree at PR head).

---

{
  "verdict": "approve",
  "summary": "Clean security dependency bump - golang.org/x/text updated from v0.38.0 to v0.39.0 with correct go.sum checksums and CHANGELOG entry referencing CVE-2026-56852. No issues found.",
  "comments": [],
  "concerns_addressed": [
    "security: golang.org/x/text version verified as v0.39.0 via pkg.go.dev",
    "correctness: go.sum checksums (h1 and go.mod) both updated to v0.39.0 and match expected values"
  ]
}