Bump grpc to 1.83.2 for CVE-2026-84445

[ai-collaboration-app]

Dev chart scan 34330594840 leaves one fixable HIGH row on this repo: CVE-2026-84445 / GHSA-2v4p-qf9q-27wj, a DoS crash in gRPC-Go xDS servers. Per the upstream GHSA the 1.83.x line is vulnerable in >= 1.83.0, < 1.83.2.

It reaches all three shipped binaries — bin/agent/agent, bin/installer/installer, bin/stackstate-cluster-agent/stackstate-cluster-agent — and all three build from the root module, so the root require is the pin that matters.

Dependabot #512 (pkg/proto) and #513 (comp/core/tagger/impl-remote) are adopted as their own commits rather than recreated. Neither reaches a shipped binary alone, because neither touches the root go.mod; the third commit adds that plus the go work sync that carries 1.83.2 into the other 18 workspace modules. Please close #512 and #513 in favour of this PR.

#503 does not fix this row and is not subsumed. It bumps comp/otelcol/otlp/components/statsprocessor to 1.83.1, still inside the vulnerable range, and that module is one of four outside go.work and outside the root build graph (with datadogconnector, pkg/dyninst/testprogs/progs, test/integration/serverless/src) that stay at v1.80.0 here and ship in no image.

Refs #509

Validation: built agent, installer and cluster-agent and read the versions back with go version -m — the same module metadata the scanners parse — all three report grpc v1.83.2 with no v1.83.1 in their embedded graphs. go work sync and go mod tidy across all 186 default modules are idempotent (CI's check-mod-tidy). go test -tags test green in pkg/util/grpc, pkg/proto, comp/core/tagger/impl-remote, pkg/config/remote. The diff is one line per go.mod, no collateral MVS movement.

---

Correction to the third commit message, which says "the other 17 workspace modules": it is 18. The branch puts 21 go.mod files at 1.83.2 in total — the root, 18 more via go work sync, and pkg/proto and comp/core/tagger/impl-remote from the two adopted Dependabot commits.

[ai-collaboration-app]

All three checks green, and the image-scan steps give a direct before/after on freshly built images rather than only a go.mod diff. Same job, two branches, grpc the only variable — #511's branch still carries 1.83.1:

Image	grpc 1.83.1 (#511 branch)	grpc 1.83.2 (this branch)
agent, amd64	8 findings, incl. CVE-2026-84445 [HIGH] pkg:golang/google.golang.org/grpc@v1.83.1 [grype,trivy]	7 findings, row gone
agent, arm64	—	7 findings, row gone
cluster-agent, amd64	2 findings, incl. the same HIGH row	1 finding, row gone
cluster-agent, arm64	—	row gone

Both scanners agreed on the row before and neither reports it after, on both published architectures. What remains in those scans is the python set (CVE-2026-15310, -15806, -17084, -19672) plus GO-2026-5932, none of which this PR touches.

go version -m on the locally built binaries agrees: agent, installer and cluster-agent all report google.golang.org/grpc v1.83.2.

One thing for whoever merges: this branch still carries the four expired exception files from stackstate-7.78.2, so its scan steps show expired: 3 on the agent image. That is #511's scope, not a defect here — but the tree only passes check-cve-exception-policy once #511 lands, so please take #511 as well rather than only this one.