[BetterAndBetterII]

What changed

• upgrade the resolved github.com/go-git/go-billy/v5 dependency from v5.8.0 to v5.9.0
• run go mod tidy, which also refreshes related indirect module pins required by the updated module graph

Why

• Dependabot alert 68 (GHSA-m3xc-h892-ggx6 / CVE-2026-44740) reports that go-billy versions before v5.9.0 can loop indefinitely on crafted symlink structures and exhaust resources
• main currently resolves go-billy to v5.8.0, so this PR lifts the runtime graph onto the patched release without also taking the broader go-git upgrade

Validation

• go mod verify
• go test ./internal/infra/workspace ./internal/workflow ./internal/httpapi ./internal/service/githubauth -count=1
• go test ./internal/chat -count=1 -run 'Test(ParseWorkspaceBranchName|ParseWorkspaceBranchNameRejectsInvalidValue|ProjectConversationWorkspaceRepoRefsDetectDetachedHEAD|ProjectConversationWorkspaceGitGraphListsLabelsAndHead|ProjectConversationWorkspaceCheckoutRejectsDirtyWorkspace|ProjectConversationWorkspaceCheckoutCreatesTrackingBranchAndRefreshesMetadata|ProjectConversationWorkspaceCheckoutCreatesNewLocalBranch|ProjectConversationWorkspaceCheckoutRemoteBranchReportsExistingLocalTrackingBranch|ProjectConversationWorkspaceCheckoutRejectsExistingNewLocalBranch|ProjectConversationWorkspaceStageAndCommitFile|ProjectConversationWorkspaceDiscardFileRestoresWorkspaceState|ProjectConversationWorkspaceStageAllAndUnstageFile|ProjectConversationWorkspaceUnstageAllRestoresUnstagedState|SummarizeConversationWorkspaceRepoHandlesUnbornHead|SummarizeConversationWorkspaceRepoMissingGitDirectoryStillSkipped)$'
• make check currently still fails in pre-existing unrelated tests: internal/chat TestConversationTerminalServiceSupportsWebsocketRuntime and internal/orchestrator TestRuntimeLauncherLaunchesWebsocketReverseRuntimeWithHooksAndArtifactSync

Relates to ASE-559.

[BetterAndBetterII]

Re-checked before Preview Deploy:

• branch fix/ase-559-go-billy is synced with main at c72b68ba
• local validation re-ran clean:
  • go mod verify
  • go test ./internal/infra/workspace ./internal/workflow ./internal/httpapi ./internal/service/githubauth -count=1
  • go test ./internal/chat -count=1 -run 'Test(ParseWorkspaceBranchName|ParseWorkspaceBranchNameRejectsInvalidValue|ProjectConversationWorkspaceRepoRefsDetectDetachedHEAD|ProjectConversationWorkspaceGitGraphListsLabelsAndHead|ProjectConversationWorkspaceCheckoutRejectsDirtyWorkspace|ProjectConversationWorkspaceCheckoutCreatesTrackingBranchAndRefreshesMetadata|ProjectConversationWorkspaceCheckoutCreatesNewLocalBranch|ProjectConversationWorkspaceCheckoutRemoteBranchReportsExistingLocalTrackingBranch|ProjectConversationWorkspaceCheckoutRejectsExistingNewLocalBranch|ProjectConversationWorkspaceStageAndCommitFile|ProjectConversationWorkspaceDiscardFileRestoresWorkspaceState|ProjectConversationWorkspaceStageAllAndUnstageFile|ProjectConversationWorkspaceUnstageAllRestoresUnstagedState|SummarizeConversationWorkspaceRepoHandlesUnbornHead|SummarizeConversationWorkspaceRepoMissingGitDirectoryStillSkipped)$'
• CI remains green for the changed-path checks

Ready for Preview Deploy / review.