chore: refresh workflow strict stack

[intel352]

Summary

• keep ratchet-cli on the current stable Workflow and agent releases: workflow v0.84.0 and workflow-plugin-agent v0.12.0
• refresh the resolved strict authz plugin dependency from workflow-plugin-authz v0.5.4 to v0.5.13
• retain existing CLI/runtime behavior; no new harness surface is added in this dependency slice

Design / Plan

• Design: GoCodeAlone/workspace docs/plans/2026-07-01-ratchet-cli-strict-stack-refresh-design.md
• Plan: GoCodeAlone/workspace docs/plans/2026-07-01-ratchet-cli-strict-stack-refresh.md
• Scope Manifest: PR Count 1, Tasks 1-5, Status Locked 2026-07-01T16:46:50Z

Verification

• go list -m github.com/GoCodeAlone/workflow github.com/GoCodeAlone/workflow-plugin-agent github.com/GoCodeAlone/workflow-plugin-authz -> v0.84.0 / v0.12.0 / v0.5.13
• go test ./internal/daemon ./internal/config ./internal/plugins ./internal/mcp ./cmd/ratchet -count=1
• go test ./... -count=1 -p=1
• go vet ./...
• golangci-lint run --new-from-rev=origin/master -> 0 issues
• go build -o ./.tmp/ratchet ./cmd/ratchet
• ./.tmp/ratchet --help; ./.tmp/ratchet version; ./.tmp/ratchet provider --help; ./.tmp/ratchet acp --help; ./.tmp/ratchet mcp --help; ./.tmp/ratchet sessions --help
• GOOS=windows GOARCH=amd64 go build ./cmd/ratchet
• GOOS=windows GOARCH=arm64 go build ./cmd/ratchet
• goreleaser check
• git diff --check

Runtime Notes

• Version-pin runtime launch validation: the built ratchet binary executed the credential-free smoke commands above with exit 0.
• Existing ACP behavior note: ratchet acp --help initializes the ACP stdio agent and exits after stdin closes instead of printing help; this was observed as existing behavior during smoke and is not changed here.
• Version-skew audit: no stale workflow-plugin-authz v0.5.4 pin remains in active module files; historical docs mention older agent/workflow versions only as archived plans.
• Doc-reconciliation: clean; this PR changes only go.mod/go.sum.

Closes #11

[Copilot]

Pull request overview

Updates ratchet-cli’s Go module dependencies to keep the project aligned with the current stable Workflow “strict stack” baseline, without changing CLI/runtime behavior.

Changes:

• Bump github.com/GoCodeAlone/workflow-plugin-authz from v0.5.4 to v0.5.13 (indirect).
• Refresh go.sum accordingly, including newly resolved transitive modules and updated hashes.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Updates the resolved strict authz plugin version and records newly required indirect modules.
go.sum	Refreshes module checksums to match the updated dependency graph (authz bump + transitive updates).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.