fix(deps): raise golang.org/x/text to v0.41.0 for GO-2026-6629

govulncheck began failing on a new advisory: a panic parsing crafted input in
x/text/secure/precis, reachable from db.Open via pgxpool. x/text is indirect
(through pgx), so the Dependency Dashboard has no update queued for it.
x/text v0.41.0 requires x/sync v0.22.0, which go mod tidy raised with it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/jackc/pgx/v5 v5.9.2
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/crypto v0.51.0
-	golang.org/x/sync v0.21.0
+	golang.org/x/sync v0.22.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -27,5 +27,6 @@ require (
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	golang.org/x/sys v0.44.0 // indirect
-	golang.org/x/text v0.39.0 // indirect
+	// x/text >= v0.41.0 for GO-2026-6629 (panic in x/text/secure/precis, reached via pgxpool).
+	golang.org/x/text v0.41.0 // indirect
 )