chore(deps): split the low-risk half of the non-major batch

[jdwlabs-agent-bot]

What

Carries the six low-risk bumps out of the Renovate non-major batch (#417) so they can land while the other three wait on a decision.

Bump	Note
prometheus/client_model 0.6.2 → 0.6.3	cli/
google.golang.org/protobuf → 1.36.12	leaves a pseudo-version for the release
golang:1.27-bookworm digest	builder for truenas-prometheus-exporter
adminer 6.0.1 digest	tag unchanged, digest re-resolved
curlimages/curl 8.21.0 → 8.22.0	digest-pinned; stale allowlist exception removed in the same commit
grafana 13.0.1 → 13.2.1
kube-prometheus-stack 88.6.1 → 88.6.5	vendored monitoring CRDs already match 88.6.5
blackbox-exporter 11.17.2 → 11.18.0

Why these three are not here

• nginx-gateway-fabric 2.6.7 → 2.7.0. Upstream moves to Gateway API 1.6.1 and promotes TCPRoute/UDPRoute to standard v1. This repo vendors Gateway API CRDs in bootstrap/crds/foundation-crds.yaml at bundle v1.1.0 (experimental channel), whose TCPRoute/UDPRoute serve only v1alpha2. No such objects exist in-repo, so the open question is whether the 2.7.0 controller's informer cache tolerates the missing v1 at startup — on sync-wave-1 core ingress.
• argo-cd 10.4.1 → 10.8.0. Adds a default application-controller livenessProbe where there was none. tenants/platform/services/argo-cd/values.yaml records that controller being OOM-killed during mass-merge sync storms and raises memory to compensate; a probe with default thresholds can restart it mid-storm instead of letting it run hot.
• truenas-csi v1.2.0 → v1.3.0. Storage driver, no upstream release notes attached.

Verification

Run locally against this tree, all green: yamllint; kubeconform over tenants/ (127 valid, 0 invalid); helm lint + helm template | kubeconform across all 6 charts; check-image-pins.py (20 pinned, 25 allowlisted, 0 unexplained); check-remote-chart-image-pins.py against the new chart revisions (24/24); check-orphaned-manifests.py; check-gitsync-tenant-folders.py; check-adr-numbering.py; sync-monitoring-crds.py (in sync with chart revision 88.6.5); tools/tests (245 tests, OK); prometheus-rules (7 success); alertmanager-routing (24 cases, 0 failures); cli/ go build, go test -race (20 packages ok), go mod verify, go mod tidy -diff, golangci-lint (0 issues); platformctl tenants validate.

The curl digest was re-verified against the live registry as the multi-arch manifest list — Docker-Content-Digest for tag 8.22.0 matches, the raw manifest-list body hashes to it, and resolving it returns a list with 5 differing children. docker manifest inspect --verbose reports the linux/386 child instead, which is the trap this avoids.

Review gate

Every path here (/cli/, /tenants/platform/, /tools/, /helm-charts/) is CODEOWNERS-gated, so this is authored under jdwlabs-agent-bot for a human code-owner approval.

Closes nothing; #417 stays open with the three held bumps.

🤖 Generated with Claude Code

[jdwillmsen]

Codeowner approval. Scope verified against origin/main independently of the authoring run: 7 files, +12/-20, and the three held bumps are provably absent — tenant.yaml carries only grafana 13.2.1, kube-prometheus-stack 88.6.5 and blackbox-exporter 11.18.0; nginx-gateway-fabric stays at 2.6.7, argo-cd at 10.4.1, and helm-charts/truenas-csi/values.yaml is not in the diff. The curl bump and its allowlist removal are in one commit, which is what image-pin-check requires. 19/19 green.