chore(deps): drop explicit docker/docker pin

[dorothyyzh]

Summary

• Drops the explicit github.com/docker/docker v28.5.2+incompatible // indirect pin from go.mod
• Runs go mod tidy so MVS resolves dependencies naturally without the explicit pin
• Resolves CVE-2026-33997 and CVE-2026-34040 by removing the vulnerable docker/docker dependency

Background

PR#581 already migrated gormx from docker/docker to moby/moby/api. However, go.mod on master still had the explicit docker/docker pin because go-bus and ratelimiter transitively required older versions of it, and go mod tidy had pinned it explicitly.

After dropping the explicit pin and running go mod tidy, docker/docker no longer appears in go.mod at all, confirming no direct or transitive dependency requires it.

Test plan

• go mod edit -droprequire github.com/docker/docker — removes the explicit pin
• go mod tidy — completes without re-adding docker/docker
• grep "docker/docker" go.mod — returns nothing (dependency is gone)
• go build ./... — passes with no errors

🤖 Generated with Claude Code