chore(release): harden OSS release readiness

[setkyar]

Summary

• update vulnerable Go dependencies and regenerate module checksums
• replace the private media migration runbook link with self-contained public guidance
• strengthen repository-local release and security hygiene guidance

Validation

• Go race tests, vet, govulncheck, and module verification
• frozen Bun install and full build
• git diff and documentation-link checks