From cefa55b3e609720484047f2a5edd5e8277a55279 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 3 Nov 2026 06:14:26 +0000
Subject: [PATCH 1/2] Update dependency farcloser/limen to v0.24.0

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .hermetic/hermetic.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.hermetic/hermetic.yaml b/.hermetic/hermetic.yaml
index fb852bb..f52d9e6 100644
--- a/.hermetic/hermetic.yaml
+++ b/.hermetic/hermetic.yaml
@@ -19,7 +19,7 @@ registries:
 packages:
   # The limen this repository runs, and with it every canonical file it
   # writes: the one canonical pin kept here, where Renovate bumps it.
-  - name: farcloser/limen@v0.22.0 # renovate: depName=farcloser/limen
+  - name: farcloser/limen@v0.24.0 # renovate: depName=farcloser/limen
     registry: local
   # The Go toolchain is the repository's own pin, seeded from limen's own
   # manifest once and Renovate's here afterwards: a standard-library fix

From 7497a36bc8d13f767cf0cc5e1a927e230f54e2c4 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 3 Nov 2026 06:17:25 +0000
Subject: [PATCH 2/2] chore: refresh checksums and converge the limen baseline

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .hermetic/aqua-checksums.json | 70 +++++------------------------------
 .limen/hermetic-registry.yaml | 32 ----------------
 .limen/hermetic.yaml          | 16 ++++----
 .limen/just/apple.just        | 17 ++++++---
 .limen/just/build-rust.just   | 13 ++++++-
 .limen/just/fix.just          |  4 +-
 .limen/just/lib.just          |  9 ++++-
 .limen/just/lint.just         |  4 +-
 .limen/just/test-go.just      | 12 +++---
 .limen/renovate.json          |  4 +-
 .limen/tools/go.mod           | 16 ++++++++
 .limen/tools/go.sum           | 36 ++++++++++++++++++
 12 files changed, 115 insertions(+), 118 deletions(-)

diff --git a/.hermetic/aqua-checksums.json b/.hermetic/aqua-checksums.json
index a013af5..2a0fa5e 100644
--- a/.hermetic/aqua-checksums.json
+++ b/.hermetic/aqua-checksums.json
@@ -66,28 +66,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_darwin_arm64.tar.gz",
-      "checksum": "F84D216ABB15016DAAB99D564C5D0655E3A836EAFEA76EE30F387DFB6D71D353",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_darwin_arm64.tar.gz",
+      "checksum": "BB7F8386488E585FE59F871CD3D5A4F74E8DA17B51118A11FE6FABA1C91E6FEB",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_linux_amd64.tar.gz",
-      "checksum": "477D22E136C061D3CA8FF4D611F475DF4736C4063F7138E4D531001EA9B27E6D",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_linux_amd64.tar.gz",
+      "checksum": "8FD7C868E5C26E3E04C2F0F83D0904D271A9D7FD596E8D4303DC9689B8869209",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_linux_arm64.tar.gz",
-      "checksum": "BA08CA6D563319AC036B322A81DDDD3B7652B5CFC42CA6D5438E436A0212A158",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_linux_arm64.tar.gz",
+      "checksum": "BDC58258E2B6280AFEF8AD7D8965D19B4AC3AB0C741C9FDC126403847F279E04",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_windows_amd64.tar.gz",
-      "checksum": "0F79B9165B032E4020482544B34FA81293D13103754824E447397E80D5A8E4AE",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_windows_amd64.tar.gz",
+      "checksum": "9B862D79FCBB33676F2304FDA902A39F7623BB543EB43693F1F8015B2531730B",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_windows_arm64.tar.gz",
-      "checksum": "A098CBA49A2C4FC4955C3062F5321D96467E84C4328D783D7CCD3DCE83D9BBC0",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_windows_arm64.tar.gz",
+      "checksum": "05F751B5F5DB7FDB8544ACC055D9330A6CFDA64897FE31339B210A64C5C1CC49",
       "algorithm": "sha256"
     },
     {
@@ -145,31 +145,6 @@
       "checksum": "1098AA1A16D737FD7075583013A75B8BAB52C0530A79B6127254C4AE0DFE4220",
       "algorithm": "sha256"
     },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_darwin_arm64.tar.gz",
-      "checksum": "76414678AC18FE16264BB4EBF1C5EBB06570D90C0ECD0814E239E41DFF1026E7",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_linux_amd64.tar.gz",
-      "checksum": "692A4B72DFF363DCDC3CD8F41C55042EAC993EFDCC08D55DF90BA5E5FD691431",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_linux_arm64.tar.gz",
-      "checksum": "D72B86DA88BDB3DDF3B4971048AF39599C75930B7FDE532C24C598734D74385B",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_windows_amd64.tar.gz",
-      "checksum": "4EA9AC7051EA25631FA58C9546D272F318D47A584AFD87757EE6CA7C0B52B919",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_windows_arm64.tar.gz",
-      "checksum": "DF122697A27F8A1F888B9037D65173A9D21BBCD2B5866E706D979C926533D8BB",
-      "algorithm": "sha256"
-    },
     {
       "id": "github_release/github.com/git-for-windows/git/v2.56.0.windows.4/Git-2.56.0.4-64-bit.tar.bz2",
       "checksum": "0DAE059764BA7C447C9604EB6CB0F4AFAF2D90B003ECF1C8CF2DBE5A13E4442C",
@@ -205,31 +180,6 @@
       "checksum": "67807490E909A37F58EF40B67601896D8D4DA2411C9839221DAE55732C243FE9",
       "algorithm": "sha256"
     },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_darwin_arm64.tar.gz",
-      "checksum": "509CB27AEF747F48FAF9BCE424F59DCF79572C905204B990EE935BBFCC7FA0E9",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_linux_amd64.tar.gz",
-      "checksum": "11CCDDEAF708EF228889F9FE2F68291A75B27013DDFC3B18156E094F5F40E8EE",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_linux_arm64.tar.gz",
-      "checksum": "7644A4C5CD1BB978D56245AEAB25A586AC5AC62ADEBED20A399548867C13499D",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_windows_amd64.tar.gz",
-      "checksum": "FD5A6DC69E46A0970593E70D85A7E75F16714E9C61D6D72CCC324EB82DF5BB8A",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_windows_arm64.tar.gz",
-      "checksum": "72A59200F83B3204CD59FD417E384DB0543C5511D7A9E38957E74A4035950943",
-      "algorithm": "sha256"
-    },
     {
       "id": "github_release/github.com/jqlang/jq/jq-1.8.2/jq-linux-amd64",
       "checksum": "B1C22172DD303F3BE49E935AA56AA48A8B7A46E0BC838B4997D3BB451495870F",
diff --git a/.limen/hermetic-registry.yaml b/.limen/hermetic-registry.yaml
index fbd8ec3..4c5bfc2 100644
--- a/.limen/hermetic-registry.yaml
+++ b/.limen/hermetic-registry.yaml
@@ -712,35 +712,3 @@ packages:
       - linux/arm64
       - windows/amd64
       - windows/arm64
-  # The YAML formatter: forkcloser/yamlfmt, upstream google/yamlfmt with its
-  # data-changing formats fixed (a placeholder leaked into output, blank lines
-  # in folded scalars): on the fleet's YAML the fork changes layout only.
-  # Release and verification in compress's shape; the binary at the archive
-  # root, .exe on windows.
-  - type: github_release
-    repo_owner: forkcloser
-    repo_name: yamlfmt
-    description: An extensible command line tool or library to format yaml files (forkcloser/yamlfmt)
-    asset: yamlfmt_{{trimV .Version}}_{{.OS}}_{{.Arch}}.tar.gz
-    format: tar.gz
-    files:
-      - name: yamlfmt
-    checksum:
-      type: github_release
-      asset: checksums.txt
-      algorithm: sha256
-      cosign:
-        bundle:
-          type: github_release
-          asset: checksums.txt.sigstore.json
-        opts:
-          - --certificate-identity
-          - https://github.com/forkcloser/yamlfmt/.github/workflows/release.yaml@refs/tags/{{.Version}}
-          - --certificate-oidc-issuer
-          - https://token.actions.githubusercontent.com
-    supported_envs:
-      - darwin/arm64
-      - linux/amd64
-      - linux/arm64
-      - windows/amd64
-      - windows/arm64
diff --git a/.limen/hermetic.yaml b/.limen/hermetic.yaml
index 545f0dd..f7f9f82 100644
--- a/.limen/hermetic.yaml
+++ b/.limen/hermetic.yaml
@@ -9,10 +9,15 @@ packages:
   # collapses a two-line `version:` pin): `aqua update` rewrites only that form
   # and treats a separate `version:` key as hand-held, and Renovate reads only
   # that form.
-  # No Go-built tool is pinned here: every one is a `tool` directive in
-  # .limen/tools/go.mod, built by the pinned go (book/tooling.md, "Go-built tools
-  # are go.mod tools"). aqua's go_install would build it once per tool
-  # version, with whichever go ran first, and share that binary.
+  # A pure-Go tool is a `tool` directive in .limen/tools/, built by the pinned
+  # go (book/tooling.md, "Go-built tools are go.mod tools"), never a pin here.
+  # The Go programs below are the ones nothing here compiles: what a write
+  # job runs (cosign and gh; goreleaser and syft in the release job, which
+  # holds contents, id-token and attestations write), each verified against
+  # its upstream's signed release rather than compiled inside that job;
+  # compress, whose programs answer to bare names on every PATH, a script's
+  # and a shell's; ossein, which links a system framework through cgo.
+  # (limen is the repository's own pin, above the import.)
   # The coreutils under their bare names, the same pin on every platform:
   # uutils on macOS and Linux, Git for Windows' MSYS2 coreutils on Windows.
   # The registry entries say why, and how each is verified.
@@ -26,14 +31,11 @@ packages:
   # afterwards): a standard-library fix must not wait for a limen release.
   - name: casey/just@1.59.0
   - name: koalaman/shellcheck@v0.11.0
-  - name: forkcloser/yamlfmt@v0.2.1
-    registry: local
   - name: lycheeverse/lychee@lychee-v0.24.2
   - name: goreleaser/goreleaser@v2.19.0
   - name: sigstore/cosign@v3.1.4
   # The SBOM generator the release lane runs over every archive (book/releasing.md).
   - name: anchore/syft@v1.55.0
-  - name: gotestyourself/gotestsum@v1.13.0
   - name: jqlang/jq@jq-1.8.2
   - name: cli/cli@v2.103.3
   # --- spec tooling (local registry; see .limen/hermetic-registry.yaml) ---
diff --git a/.limen/just/apple.just b/.limen/just/apple.just
index 1552b4e..c948041 100644
--- a/.limen/just/apple.just
+++ b/.limen/just/apple.just
@@ -43,9 +43,11 @@ apple-verify-signed bundle:
     fi
 
 # The stapled notarization ticket: Contents/CodeResources is where stapler
-# writes it, and `stapler validate` is the check that needs no network, the
-# one Gatekeeper makes offline. spctl has no assessment for a plug-in (its
-# execute type answers for app bundles alone), so it is not consulted.
+# writes it. `stapler validate` asks Apple's ticket service for the record, so
+# a dropped connection fails it with nothing wrong in the bundle: it is tried
+# three times before the bundle is refused. spctl has no assessment for a
+# plug-in (its execute type answers for app bundles alone), so it is not
+# consulted.
 [doc('Assert a bundle carries a stapled notarization ticket that validates')]
 apple-verify-notarized bundle:
     #!/usr/bin/env bash
@@ -53,7 +55,11 @@ apple-verify-notarized bundle:
     fail() { echo "apple-verify-notarized: $*" >&2; exit 1; }
     bundle='{{ bundle }}'
     [ -f "$bundle/Contents/CodeResources" ] || fail "no notarization ticket is stapled to $bundle"
-    xcrun stapler validate "$bundle" || fail "the ticket stapled to $bundle does not validate"
+    for attempt in 1 2 3; do
+        xcrun stapler validate "$bundle" && break
+        [ "$attempt" -lt 3 ] || fail "the ticket stapled to $bundle does not validate"
+        sleep $((attempt * 10))
+    done
     echo "apple-verify-notarized: $bundle carries a valid stapled ticket"
 
 # Submit the signed bundle to Apple and staple the ticket. The verdict is
@@ -85,8 +91,9 @@ apple-notarize bundle:
         [ -z "$id" ] || xcrun notarytool log "$id" "${key[@]}" >&2 || true
         exit 1
     fi
+    # staple validates what it writes; a second validate only asks the
+    # network again.
     xcrun stapler staple "$bundle"
-    xcrun stapler validate "$bundle"
     echo "apple-notarize: $bundle notarized (submission ${id:-?}), ticket stapled"
 
 # ditto, not zip: the archiver that keeps a bundle's extended attributes and
diff --git a/.limen/just/build-rust.just b/.limen/just/build-rust.just
index eab8a3a..8ec108d 100644
--- a/.limen/just/build-rust.just
+++ b/.limen/just/build-rust.just
@@ -57,7 +57,18 @@ targets +triples: (_banner "build rust" "targets")
     # directory.
     export ZIG_GLOBAL_CACHE_DIR="$LIMEN_BUILD/zig/global" ZIG_LOCAL_CACHE_DIR="$LIMEN_BUILD/zig/local"
     export CARGO_ZIGBUILD_CACHE_DIR="$LIMEN_BUILD/zig/cargo-zigbuild"
+    # For the host's own triple, cargo-zigbuild sets target-applies-to-host to
+    # false: build scripts and proc-macros stop reading [target.<host>] and
+    # read [host] instead. The linker rust_env gave the host (the arm64
+    # Windows one, which ships none) goes to [host] for that build.
+    host="$(rustc -vV | sed -n 's/^host: //p')"
+    host_linker_var="CARGO_TARGET_$(printf '%s' "$host" | tr 'a-z-' 'A-Z_')_LINKER"
+    host_linker="${!host_linker_var:-}"
     for triple in "$@"; do
         echo "→ target/$triple/release"
-        cargo zigbuild --release --locked --target "$triple"
+        if [ "$triple" = "$host" ] && [ -n "$host_linker" ]; then
+            CARGO_UNSTABLE_HOST_CONFIG=true CARGO_HOST_LINKER="$host_linker" cargo zigbuild --release --locked --target "$triple"
+        else
+            cargo zigbuild --release --locked --target "$triple"
+        fi
     done
diff --git a/.limen/just/fix.just b/.limen/just/fix.just
index bf7bf35..aabc85f 100644
--- a/.limen/just/fix.just
+++ b/.limen/just/fix.just
@@ -36,8 +36,8 @@ just: (_banner "fix" "just")
         just --fmt --justfile "$f"
     done < "$list"
 
-yaml: (_banner "fix" "yaml")
-    yamlfmt -conf .limen/.yamlfmt
+yaml: (_banner "fix" "yaml") (_go-tool "yamlfmt" "github.com/forkcloser/yamlfmt/cmd/yamlfmt")
+    "$LIMEN_BUILD/tools/yamlfmt" -conf .limen/.yamlfmt
 
 # Regenerate .hermetic/aqua-checksums.json from .hermetic/hermetic.yaml — the
 # mutating twin of `just do lint aqua` (needs network). In the default set so
diff --git a/.limen/just/lib.just b/.limen/just/lib.just
index d94ba03..1c29104 100644
--- a/.limen/just/lib.just
+++ b/.limen/just/lib.just
@@ -145,10 +145,15 @@ rust_env := '''
 # dependencies past what upstream tested). The isolated module wins when both
 # exist. A directive missing from both fails with the recipe that adds it.
 # Recipes depend on this with the tool's name and package, then call
-# .build/tools/<name>.
-_go-tool name pkg:
+# .build/tools/<name>. A third argument names a file the recipe needs to run
+# at all (go.mod for a lane CI runs everywhere): without it the tool is not
+# built, so a repository with no Go module is not asked for the directive.
+_go-tool name pkg requires='':
     #!/usr/bin/env bash
     set -euo pipefail
+    if [ -n '{{ requires }}' ] && [ ! -f '{{ requires }}' ]; then
+        exit 0
+    fi
     pattern='^(tool[[:space:]]+)?[[:space:]]*{{ pkg }}([[:space:]]|$)'
     if grep -qE "$pattern" '.limen/tools/{{ name }}/go.mod' 2>/dev/null; then
         mkdir -p "$LIMEN_BUILD/tools" && GOOS='' GOARCH='' CGO_ENABLED=0 go -C '.limen/tools/{{ name }}' build -o "$LIMEN_BUILD/tools/" '{{ pkg }}'
diff --git a/.limen/just/lint.just b/.limen/just/lint.just
index 8ea40f5..cab92d9 100644
--- a/.limen/just/lint.just
+++ b/.limen/just/lint.just
@@ -79,8 +79,8 @@ dockerfile: (_banner "lint" "dockerfile") (_go-tool "godolint" "github.com/forkc
     # pinned one, here.
     [ ${#files[@]} -eq 0 ] || "$LIMEN_BUILD/tools/godolint" "${files[@]}"
 
-yaml: (_banner "lint" "yaml")
-    yamlfmt -conf .limen/.yamlfmt -lint
+yaml: (_banner "lint" "yaml") (_go-tool "yamlfmt" "github.com/forkcloser/yamlfmt/cmd/yamlfmt")
+    "$LIMEN_BUILD/tools/yamlfmt" -conf .limen/.yamlfmt -lint
 
 shell: (_banner "lint" "shell")
     #!/usr/bin/env bash
diff --git a/.limen/just/test-go.just b/.limen/just/test-go.just
index a0740ca..25233b5 100644
--- a/.limen/just/test-go.just
+++ b/.limen/just/test-go.just
@@ -38,9 +38,9 @@ _prepare:
     fi
 
 # Unit tests.
-unit: (_banner "test go" "unit") _prepare
+unit: (_banner "test go" "unit") _prepare (_go-tool "gotestsum" "gotest.tools/gotestsum")
     CGO_ENABLED="{{ go_cgo }}" \
-        gotestsum -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" ./...
+        "$LIMEN_BUILD/tools/gotestsum" -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" ./...
 
 # Unit tests under the race detector. External linkmode: the detector injects
 # runtime/cgo, and hardened CGO_CFLAGS make those objects reference libc
@@ -55,7 +55,7 @@ unit: (_banner "test go" "unit") _prepare
 # legs run the detector natively; any other probe failure is real. No go.mod
 # at all: says so and passes, like fuzz, since CI runs this in every
 # repository.
-race: (_banner "test go" "race") _prepare
+race: (_banner "test go" "race") _prepare (_go-tool "gotestsum" "gotest.tools/gotestsum" "go.mod")
     #!/usr/bin/env bash
     set -euo pipefail
     if [ ! -f go.mod ]; then
@@ -71,7 +71,7 @@ race: (_banner "test go" "race") _prepare
         printf '%s\n' "$probe" >&2
         exit 1
     fi
-    gotestsum -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" -ldflags=-linkmode=external -race ./...
+    "$LIMEN_BUILD/tools/gotestsum" -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" -ldflags=-linkmode=external -race ./...
 
 # Every Fuzz* target for a short budget (TEST_GO_FUZZ_TIME, default 10s).
 # Driven by `go test -fuzz`, one target per invocation — only that build
@@ -136,13 +136,13 @@ fuzz: (_banner "test go" "fuzz") _prepare
 # Coverage: per-function summary, an HTML report under .build/coverage/, and an
 # optional minimum gate — export TEST_GO_COVER_MIN := '80' (integer percent)
 # from the root .justfile to enforce a floor; unset or 0 reports without gating.
-cover: (_banner "test go" "cover") _prepare
+cover: (_banner "test go" "cover") _prepare (_go-tool "gotestsum" "gotest.tools/gotestsum")
     #!/usr/bin/env bash
     set -euo pipefail
     export CGO_ENABLED="{{ go_cgo }}"
     dir="$LIMEN_BUILD/coverage"
     mkdir -p "$dir"
-    gotestsum -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" -coverprofile="$dir/coverage.out" ./...
+    "$LIMEN_BUILD/tools/gotestsum" -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" -coverprofile="$dir/coverage.out" ./...
     go tool cover -func="$dir/coverage.out"
     go tool cover -html="$dir/coverage.out" -o "$dir/coverage.html"
     echo "HTML report: $dir/coverage.html"
diff --git a/.limen/renovate.json b/.limen/renovate.json
index 3d8de88..a24afd8 100644
--- a/.limen/renovate.json
+++ b/.limen/renovate.json
@@ -14,7 +14,7 @@
     "postUpdateOptions gomodTidy: a Go module bump rewrites go.mod; without tidy, go.sum keeps the old module's lines and `just do lint go mod` (go mod tidy, diffed) fails every gomod PR. gomodUpdateImportPaths is what keeps tidy running on a MAJOR bump: without it Renovate skips tidy on every major (its guard for the /vN import-path rewrite, which must precede tidy), and a v0 to v1 bump is major while changing no path, so the PR landed a go.sum with the new go.mod hash, no h1 line and the old pseudo-version lines still in it, green for Renovate and red on the tidy diff. With the option, v0 to v1 does no path rewrite and tidies; a real /vN bump rewrites the imports with marwan-at-work/mod (which Renovate go-installs at run time, no image support needed) and then tidies.",
     "constraints gomodMod: the version Renovate go-installs marwan-at-work/mod at for that rewrite; without it the install is @latest, a third-party binary that rewrites import paths across the tree fetched at whatever is newest the day a /vN bump lands. Pinned means by digest, and this lever takes only a v-prefixed tag, so this is the nearest the lever allows: a version pin, its content fixed and transparency-logged by the checksum database that go install verifies against. Named here as that exception rather than left implicit. Renovate's own config manager marks this constraint unsupported and never scans a preset, so limen's renovate.json watches the value with a custom manager and proposes its bumps there.",
     "packageRules, content-pinned files: the checksum-update workflow, the shared CI lanes (limen-verify.yaml), the security workflow, the setup-hermetic, cache and windows-cache-image actions and everything under .limen/ are limen's byte for byte; a bump Renovate makes inside one is drift the next `limen check` rejects. Their pins move in limen's own repository, the one place Renovate keeps touching them, and reach every other repository through a limen release.",
-    "packageRules, Go-built tools: the tool directives under .limen/tools/ (git-validation, godolint, dot, the Go-source analyzers deadcode, govulncheck, go-licenses, and golangci-lint in .limen/tools/golangci-lint/go.mod, a module of its own so its analyzers' dependencies stay upstream's), which Go lists as // indirect and the gomod manager would skip; re-enabled exactly, by module. dot is forkcloser's own tagged module (upstream's cmd/dot is a nested module without tags), so it moves like the others, and as one of ours it is proposed without the cooldown. Two rules, by file: .limen/tools/go.mod for the shared tools, .limen/tools/*/go.mod for golangci-lint and nilaway only. One rule over every gomod file re-enabled golang.org/x/tools where it is a plain // indirect requirement of golangci-lint's and nilaway's own modules, and bumped it past the version each upstream pins (forkcloser/infra#10): the isolated module exists so that graph stays upstream's, so nothing in it moves but the tool itself.",
+    "packageRules, Go-built tools: the tool directives under .limen/tools/ (git-validation, godolint, dot, yamlfmt, gotestsum, the Go-source analyzers deadcode, govulncheck, go-licenses, and golangci-lint and nilaway in .limen/tools/<name>/go.mod, each a module of its own so its dependencies stay upstream's), which Go lists as // indirect and the gomod manager would skip; re-enabled exactly, by module. dot is forkcloser's own tagged module (upstream's cmd/dot is a nested module without tags), so it moves like the others, and as one of ours it is proposed without the cooldown. Two rules, by file: .limen/tools/go.mod for the shared tools, .limen/tools/*/go.mod for the isolated tools only. One rule over every gomod file re-enabled golang.org/x/tools where it is a plain // indirect requirement of golangci-lint's and nilaway's own modules, and bumped it past the version each upstream pins (forkcloser/infra#10): the isolated module exists so that graph stays upstream's, so nothing in it moves but the tool itself.",
     "packageRules, groups: one pull request per repository per kind, not one per dependency — a registry ref that moves most days and a dozen tool pins were arriving as a dozen pull requests a month per repository, each reviewed alone. Three groups: `aqua tools` (every third-party pin in .hermetic/hermetic.yaml and the standard-registry ref), `github actions`, and `go modules` (non-major gomod bumps, the .limen/tools/go.mod directives included). Renovate keeps the one open pull request current as further versions arrive instead of opening another. Grouped, not scheduled: a bump still arrives as soon as its cooldown ends. Outside the groups on purpose: our own releases (immediate and alone, so a limen bump is its own reviewed change), major Go bumps (code may have to move), pins.yaml entries (each a deliberate supply-chain change), and security fixes, which Renovate's vulnerabilityAlerts defaults keep ungrouped. A repository that wants a dependency out of a group adds a later packageRule with groupName null.",
     "packageRules, golang/go, versioning: Go tags its releases go1.N.M, and the candidates golang/go offers are tags (it publishes no GitHub release). The regex managers' default versioning, semver-coerced, parses such a tag but calls every one unstable, since its stability check accepts only a bare or v-prefixed number; from a current version it holds unstable, Renovate lets through only a candidate with the same major, minor and patch, so no bump was ever proposed, silently. Regex versioning that carries the prefix parses the pin and the candidates alike, as lychee's does, and leaves the rc tags out by construction. Out of the aqua tools group: a toolchain patch is the standard-library fix the pin exists to receive without delay, in a pull request that names it.",
     "packageRules, lychee: releases are tagged lychee-vX.Y.Z next to lychee-lib-vX.Y.Z and nightly; regex versioning that carries the prefix parses the pin and the candidates alike and excludes the others by construction.",
@@ -128,6 +128,8 @@
         "github.com/forkcloser/git-validation",
         "github.com/forkcloser/godolint",
         "github.com/forkcloser/dot",
+        "github.com/forkcloser/yamlfmt",
+        "gotest.tools/gotestsum",
         "golang.org/x/tools",
         "golang.org/x/vuln",
         "github.com/forkcloser/go-licenses"
diff --git a/.limen/tools/go.mod b/.limen/tools/go.mod
index b93e186..32552bb 100644
--- a/.limen/tools/go.mod
+++ b/.limen/tools/go.mod
@@ -10,19 +10,30 @@ tool (
 	github.com/forkcloser/git-validation/cmd/git-validation
 	github.com/forkcloser/go-licenses/cmd/go-licenses
 	github.com/forkcloser/godolint/cmd/godolint
+	github.com/forkcloser/yamlfmt/cmd/yamlfmt
 	golang.org/x/tools/cmd/deadcode
 	golang.org/x/vuln/cmd/govulncheck
+	gotest.tools/gotestsum
 )
 
 require (
 	github.com/alecthomas/kong v1.16.1 // indirect
+	github.com/bitfield/gotestdox v0.2.2 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.3 // indirect
 	github.com/containerd/typeurl/v2 v2.3.0 // indirect
+	github.com/dnephin/pflag v1.0.7 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/forkcloser/dot v1.3.1 // indirect
 	github.com/forkcloser/git-validation v0.1.1 // indirect
 	github.com/forkcloser/go-graphviz v0.5.2 // indirect
 	github.com/forkcloser/go-licenses v0.1.1 // indirect
 	github.com/forkcloser/godolint v0.5.1 // indirect
+	github.com/forkcloser/yamlfmt v0.2.1 // indirect
+	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/lmittmann/tint v1.2.1 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/moby/buildkit v0.34.0 // indirect
 	github.com/mycophonic/primordium v0.15.1 // indirect
@@ -30,16 +41,21 @@ require (
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/tetratelabs/wazero v1.12.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/image v0.47.0 // indirect
 	golang.org/x/mod v0.42.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e // indirect
+	golang.org/x/term v0.46.0 // indirect
 	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/tools v0.52.0 // indirect
 	golang.org/x/vuln v1.9.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
+	gotest.tools/gotestsum v1.13.0 // indirect
 	mvdan.cc/sh/v3 v3.14.1 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/.limen/tools/go.sum b/.limen/tools/go.sum
index 63e486a..0369b85 100644
--- a/.limen/tools/go.sum
+++ b/.limen/tools/go.sum
@@ -4,10 +4,18 @@ github.com/alecthomas/kong v1.16.1 h1:ixhCt93XkJ98kGposQ54+bl0IK6XwqB40AsMynU7Z8
 github.com/alecthomas/kong v1.16.1/go.mod h1:wrlbXem1CWqUV5Vbmss5ISYhsVPkBb1Yo7YKJghju2I=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/bitfield/gotestdox v0.2.2 h1:x6RcPAbBbErKLnapz1QeAlf3ospg8efBsedU93CDsnE=
+github.com/bitfield/gotestdox v0.2.2/go.mod h1:D+gwtS0urjBrzguAkTM2wodsTQYFHdpx8eqRJ3N+9pY=
+github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI=
+github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/containerd/typeurl/v2 v2.3.0 h1:HZHPhRWo5XMy3QGQoPrUzbW/2ckwjfweHmOwlkIrPAQ=
 github.com/containerd/typeurl/v2 v2.3.0/go.mod h1:Qk+PAdUYArVj41TnGi6rJ+48RF0PkcTc4i/taoBcK0w=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dnephin/pflag v1.0.7 h1:oxONGlWxhmUct0YzKTgrpQv9AUA1wtPBn7zuSjJqptk=
+github.com/dnephin/pflag v1.0.7/go.mod h1:uxE91IoWURlOiTUIA8Mq5ZZkAv3dPUfZNaT80Zm7OQE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/forkcloser/dot v1.3.1 h1:jhKEBkdZ8PJYgyohT74+I0zYr0NRXwdTWAsZfAJFaBU=
 github.com/forkcloser/dot v1.3.1/go.mod h1:pM3Q/7e6Ac/vY+7J21Q7QoL69wYSni71xt5SfUkR8Ck=
 github.com/forkcloser/git-validation v0.1.1 h1:A1FkfOHKgkqCC21/DSTjYlY7IlvbRtnvFAZDO2bQMbc=
@@ -18,6 +26,10 @@ github.com/forkcloser/go-licenses v0.1.1 h1:VzTtRdQCmJMSP9EWSr9aTAjzCUNajW2hzb/l
 github.com/forkcloser/go-licenses v0.1.1/go.mod h1:kWjKtze8KoScVq3ifYckfCwXRxFbOPnNIdA7tXSsAq0=
 github.com/forkcloser/godolint v0.5.1 h1:hLfaabqsdaWFruEqQijUd4hwI+uNISL24LKOrlIolk4=
 github.com/forkcloser/godolint v0.5.1/go.mod h1:cev6BNLOrnT1khxHkC6G3jS0nFH9tkZHnbLsLBq0qNw=
+github.com/forkcloser/yamlfmt v0.2.1 h1:I6EVh6hskPS+c0DTHDev8QXLuRPRqGuH45xp+9EwchQ=
+github.com/forkcloser/yamlfmt v0.2.1/go.mod h1:4qnRMKISOQZBrQ/QwA4BHU5OtXXTN7W+4SqHHYm4z84=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
 github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU=
@@ -26,6 +38,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -37,6 +51,9 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lmittmann/tint v1.2.1 h1:zOadah+f+nSm3jZM044jOsqh0+vSfgG/d9Ota9a/TLE=
 github.com/lmittmann/tint v1.2.1/go.mod h1:HIS3gSy7qNwGCj+5oRjAutErFBl4BzdQP6cJZ0NfMwE=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/moby/buildkit v0.34.0 h1:bG5h2y1s5IVvc/uSGo6hVlYbd2eXVFRuADl9Zf+jeJM=
@@ -54,14 +71,19 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
 github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
+github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
+github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=
 github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/image v0.47.0 h1:za/8gVz++PPZqmZJBNSISICN5Rrj5zixP/8K++fgmqo=
@@ -70,10 +92,13 @@ golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
 golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
 golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
 golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e h1:P6NGsugec4oASJ+yKMNgTndeo0h2CbixZLvQIe9h5R4=
 golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e/go.mod h1:GNu+nb+E5axfGmP+Uu3ZVQu5lE/Xk42MjZOHWUD94/o=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
 golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
@@ -88,7 +113,18 @@ google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fw
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/gotestsum v1.13.0 h1:+Lh454O9mu9AMG1APV4o0y7oDYKyik/3kBOiCqiEpRo=
+gotest.tools/gotestsum v1.13.0/go.mod h1:7f0NS5hFb0dWr4NtcsAsF0y1kzjEFfAil0HiBQJE03Q=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
 mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=