build(deps): bump x/crypto to 0.55.0

[parithosh]

Summary

• upgrade golang.org/x/crypto from 0.54.0 to 0.55.0
• include the transitive x/text, x/tools, x/mod, and x/telemetry versions selected by go mod tidy
• close GO-2026-6303 / CVE-2026-56854 after build(deps): bump the go-minor-patch group across 1 directory with 17 updates #340 merged the affected version

Reachability

Panda imports x/crypto/argon2; go list -deps ./... does not include golang.org/x/crypto/ssh. The vulnerable SSH path is therefore not reachable in shipped code, but updating removes the affected module version from the graph.

Verification

• make test
• go tool govulncheck ./...
• go mod tidy && git diff --exit-code go.mod go.sum

[redpandabot]

Bumps golang.org/x/crypto from 0.54.0 to 0.55.0 along with the tidy-selected x/text 0.41.0, x/mod 0.38.0, x/tools 0.48.0, and x/telemetry updates. OSV confirms the bump is a strict improvement (removes GO-2026-6303; the only remaining advisory GO-2026-5932 is version-independent and equally present at 0.54.0), the transitive versions match x/crypto 0.55.0's own go.mod, and the diff is minimal version-only churn. Clean.

---

_{Reviewed 2 changed file(s) @ 8c6ef708 — no blocking issues found.
"Cheaper to fly to Vietnam than to fix it here."}

[github-actions]

🐼 Smoke eval — 8c6ef70: ✅ 9/9 pass

📊 Interactive report — tokens p50 104,927 · tokens/solve 181,089.

Reference points: master@5ed16b4 100%.

question	result	tokens	tools
forky_node_coverage	✅	84,808	7
tracoor_node_coverage	✅	103,971	8
mainnet_block_arrival_p50	✅	104,927	7
list_datasources	✅	36,747	2
block_count_24h	✅	155,519	13
missed_slots_24h	✅	355,642	29
chartkit_default_arrival_distribution	✅	598,444	34
storage_upload_session_scoped	✅	116,064	7
evm_faucet_fund_throwaway_address	✅	73,678	8

🔭 Langfuse traces (9 runs; ⚠️ = failed)

• forky_node_coverage
• tracoor_node_coverage
• mainnet_block_arrival_p50
• list_datasources
• block_count_24h
• missed_slots_24h
• chartkit_default_arrival_distribution
• storage_upload_session_scoped
• evm_faucet_fund_throwaway_address

_{The report walks this branch's commits against the master baseline and the most recent release. A self-contained copy is in the run's eval-smoke-* artifact.}