Dependency sweep after the October Go security releases. Changes: - indigo 2026-09-01 -> 2026-10-20 (bdacece), chi v5.5.0, goose v3.29.0, otel v1.47.0 / otelhttp v0.72.0, x/image v0.47.0, x/net v0.61.0, x/sync v0.24.0, x/time v0.16.0, with their transitive bumps. - indigo deprecated its xrpc and repo packages. Coves keeps them for now, with targeted SA1019 nolint comments: atproto/repo's LoadRepoFromCAR expands the whole MST eagerly (an exponential-work risk on untrusted CARs in FetchPost), and atclient changes error formatting, 429 details and URL handling in token refresh and provisioning. The migration is tracked separately. - indigo's syntax.ParseCID now rejects every CIDv0 ("Qm..."), so the image proxy refuses them; production holds no CIDv0 values. Two validation test cases now expect ErrInvalidCID. - PDS 0.4.5027 -> 0.4.5037 by digest in prod and CI (SSRF hardening on identity and push fetches, bounded proxy responses, rejection of MSTs with repeated nodes); dev's floating pds:latest pinned to the same digest, Jaeger pinned to 1.76.0. - golangci-lint v2.15.0; tests now use the errors they used to discard from error channels. govulncheck: 0 reachable (only the unfixable x/crypto/openpgp module notice remains). make ci passed: 11555 + 537 tests, 0 failures, 0 skips. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>