Fix snippets/golang build and bump grpc to v1.82.1 (GHSA-hrxh-6v49-42gf)

[lcbill]

Summary

Two things, and the second is a prerequisite for the first.

Advisory	Severity	Package	Old	New
GHSA-hrxh-6v49-42gf	HIGH	google.golang.org/grpc	1.80.0	1.82.1

snippets/golang does not build on master

The module pins go-limacharlie/limacharlie at pseudo-version v0.0.0-20260726172822-e1078d02bc52, and that revision no longer exists upstream:

estimate/main.go:6:2: github.com/refractionPOINT/go-limacharlie/limacharlie@v0.0.0-20260726172822-e1078d02bc52:
    invalid version: unknown revision e1078d02bc52

Verified by building a clean origin/master worktree — go build ./... fails there. Because the module graph cannot resolve, go get for grpc aborted too, which is why this advisory could not be remediated without fixing the pin first.

Repointed to the latest published revision, v0.0.0-20260730214850-66dd27031dd3 (this needed go mod edit -require=, since go get resolves the existing broken pin before applying an upgrade).

Test plan

• go build ./... — passes (fails on clean master, see above)
• go vet ./... — passes
• grpc resolved at v1.82.1, above the < 1.82.1 affected range
• No version downgraded; go directive unchanged

Notes

Only snippets/golang/go.mod and go.sum change. The transitive upgrades (otel contrib, x/oauth2, genproto, envoy) are MVS consequences of the two direct bumps.