maintainerconfig: add goUpdate.autoUpdate consent flag

[bborbe]

Summary

• Add GoUpdateConfig (goUpdate.autoUpdate bool) to MaintainerConfig, following the existing ReleaseConfig/PrReviewerConfig shape exactly.
• Per-repo consent flag the upcoming github-update-go-watcher will gate on. File/section/key absent all read as false (opt-in, not opt-out) — same trust-gate contract as release.autoRelease.
• Repo health: bump golang.org/x/mod v0.37.0→v0.40.0 (govulncheck GO-2026-6179/GO-2026-6180) and Go 1.26.5→1.26.6 (stdlib GO-2026-5026/GO-2026-5972/GO-2026-6090) — both were pre-existing baseline breaks unrelated to the schema change, needed to get precommit green.

Scope is deliberately narrow: schema field + parse tests + CHANGELOG. No watcher logic, no other-repo changes.

Test plan

• make precommit green (tests, lint, vet, govulncheck, osv-scanner, trivy)
• New DescribeTable entries cover: key present true, key present false, section absent, file absent (empty bytes)

[ben-s-pull-request-reviewer]

Now I have everything I need. Let me analyze the findings:

Finding 1: go-parse/paired-parse-and-parsedefault at maintainerconfig.go:139

• The rule says: "EXEMPT: functions in packages that explicitly only need one variant (e.g. internal parsing never exposed with a default)"
• The package docs state: "Parse does NO I/O — fetching the bytes is each consumer's job" and the two functions (Parse vs ParseStrict) serve intentionally different purposes (lenient vs strict). This is exempt.

Finding 2: go-testing/suite-test-file-required at maintainerconfig_test.go:15

• The suite file maintainerconfig_suite_test.go already exists with RunSpecs(t, "Maintainerconfig Suite") at line 16. This is a false positive from the rule's glob pattern failing to see the suite file in the same directory.

Adjudication of the PR change itself:

• GoUpdateConfig follows the exact same pattern as ReleaseConfig and PrReviewerConfig — consistent, correct
• goUpdate follows the established YAML tag naming convention (yaml:"goUpdate")
• Comprehensive test coverage with 4 new DescribeTable entries covering true/false/absent/absent-file cases
• Security fixes in go.mod (golang.org/x/mod, Go 1.26.5→1.26.6) are appropriate
• CHANGELOG entry is clear and accurate

The PR is clean. No issues to flag.

---

Step 5: Consolidated Report

Selector Mode Traceability:

• Candidates: 0 rules matched by Step 4b-i glob filter (no judgment rules triggered by these Go/YAML changes)
• Applicable: 0
• Skipped: N/A — no candidates produced

Must Fix (Critical): None.

Should Fix (Important): None.

Nice to Have (Optional): None.

---

Verdict

{
  "verdict": "approve",
  "summary": "PR adds GoUpdateConfig following the established ReleaseConfig/PrReviewerConfig pattern exactly. The go.mod bumps address security advisories GO-2026-6179/GO-2026-6180 and GO-2026-5026/GO-2026-5972/GO-2026-6090. The mechanical funnel findings are both false positives: (1) Parse/ParseStrict serve intentionally different purposes so no Default variant is needed, and (2) maintainerconfig_suite_test.go exists with RunSpecs.",
  "comments": [],
  "concerns_addressed": [
    "security: golang.org/x/mod v0.37.0→v0.40.0 fixing govulncheck GO-2026-6179/GO-2026-6180 — addressed by go.mod/go.sum changes",
    "security: Go 1.26.5→1.26.6 fixing stdlib GO-2026-5026/GO-2026-5972/GO-2026-6090 — addressed by go.mod change",
    "correctness: GoUpdateConfig opt-in default (absent=false) is consistent with ReleaseConfig/PrReviewerConfig — verified by code inspection"
  ]
}