chore(deps): bump the go-modules group (gofeed held back) and fix the dapr SA1019

[IAmBod]

Supersedes #208. Takes the dependency group bump and makes it pass the gates.

Two things were blocking #208:

1. golangci-lint — SA1019. The dapr/go-sdk v1.15.0 bump deprecates
NewClientWithAddress. Switched to the documented replacement
NewClientWithAddressContext, which also lets the caller's context govern the
SDK's blocking dial instead of it being silently dropped. Covered by a new test
(TestNewHonoursContextCancellation) that fails on the old constructor.

2. benchmark regression gate — a real ~2x hit on the parse hot path. The
group moved mmcdole/gofeed 1.3.0 → 1.4.1. Measured in isolation on top of
main, with the Go toolchain held constant so the go directive change isn't
a confounder:

ParseRSS-16  sec/op       707.7µ → 1330.0µ   +87.94% (p=0.002 n=6)
ParseRSS-16  B/op        878.9Ki → 1572.7Ki  +78.95% (p=0.002 n=6)
ParseRSS-16  allocs/op     8.498k → 24.801k  +191.85% (p=0.002 n=6)

Those numbers match the full-group failure exactly, so gofeed is the whole
regression. This branch holds gofeed at v1.3.0 and takes the other 56 updates;
with the pin, ParseRSS returns to baseline (~, p=0.310). The gofeed upgrade
needs its own investigation before it lands.

Verification

Run locally on this branch — go build ./... clean, go test -race ./...
48/48 packages ok, golangci-lint run ./... 0 issues, and
scripts/bench-compare.sh shows no significant change on any hot-path
benchmark. Integration tests not run locally (Docker-backed); CI covers them.