fix(deps): grouped gomod updates skip the desktop module, so the talos group PR fails before reaching the real bump

> 🤖 Generated by the Agentic Engineer

## Evidence

Dependabot's **grouped** gomod updates in this repository update only the root module, while
**ungrouped** ones update both modules. Measured across six PRs on 2026-09-01:

| PR | grouped? | files changed |
|---|---|---|
| [#6797](https://github.com/devantler-tech/ksail/pull/6797) `golang.org/x/mod` (merged) | no | `go.mod` `go.sum` **`desktop/go.mod` `desktop/go.sum`** |
| [#6798](https://github.com/devantler-tech/ksail/pull/6798) `azcore` (merged) | no | `go.mod` `go.sum` **`desktop/go.mod` `desktop/go.sum`** |
| [#6799](https://github.com/devantler-tech/ksail/pull/6799) `sigstore-go` (merged) | no | `go.mod` `go.sum` **`desktop/go.mod` `desktop/go.sum`** |
| [#6724](https://github.com/devantler-tech/ksail/pull/6724) `omni/client` | no | `go.mod` `go.sum` **`desktop/go.mod` `desktop/go.sum`** |
| [#6796](https://github.com/devantler-tech/ksail/pull/6796) `machinery` | no | `go.mod` `go.sum` **`desktop/go.mod` `desktop/go.sum`** |
| [#6813](https://github.com/devantler-tech/ksail/pull/6813) **talos group** | **yes** | `go.mod` `go.sum` — **`desktop/` NOT updated** |

The consequence is a build failure that never reaches the real dependency question. `#6813` @
`da13b012c7`, job `99668418073` (`🏗️ Build (Linux)`), failing step `go build -o ksail-desktop .`:

```
go: updates to go.mod needed; to update it:
go mod tidy
```

`desktop/go.mod` carries the root module's transitive requirements as `// indirect` (it declares
`replace github.com/devantler-tech/ksail/v7 => ../`, and at `da13b012c7` still pins
`github.com/siderolabs/omni/client v1.9.1 // indirect`). When the root module moves and `desktop/`
does not, the desktop build is stale by construction.

Config context: `.github/dependabot.yaml` has exactly **one** `gomod` entry (`directory: /`), there is
**no** `/desktop` entry, and there is **no `go.work`**. So the second module is not independently
configured — yet ungrouped updates reach it and grouped ones do not.

## Why this matters

The `talos` group was introduced deliberately by #6801 to stop the lockstep skew that breaks #6724 and
#6796. That fix works as designed — `#6813` does move `talos`, `machinery`, `omni/client` and
`image-factory` together. But it can never demonstrate that, because it fails in a *different* module
first, for an unrelated reason. The remedy for one defect is masked by a second one.

This is currently **latent rather than blocking**: #6728 records a live-verified upstream wall
(`loft-sh/apiserver` pins k8s 0.36; Talos ≥ `beta.0` needs 0.37; `alpha.2` is the last Talos release on
the 0.36 line), so `#6813` could not merge today even with `desktop/` refreshed. The cost is that when
that wall clears, the group PR will still fail — and the next run will re-derive this from scratch, as
this one did.

## Alternative explanation considered

That Dependabot skipped `desktop/` because the update is *unsatisfiable* there, rather than because it
is grouped. The three ungrouped talos-line PRs are the control: **#6724 and #6796 carry the same
unsatisfiable bump and still updated `desktop/`.** So unsatisfiability alone does not explain the
difference; grouping is the variable that changed. Stated as a measured contrast, not a claim about
Dependabot's internals.

## Expected behaviour

A grouped gomod update updates every module it affects, exactly as an ungrouped one does — so a group
PR fails (or passes) for the actual dependency reason.

## Acceptance criteria

- A grouped gomod PR touching the root module also updates `desktop/go.mod` and `desktop/go.sum`.
- `#6813`-shaped PRs fail (while #6728's wall stands) on the *dependency* incompatibility, not on
`go: updates to go.mod needed`.
- Whichever mechanism is chosen — a `/desktop` gomod entry mirroring the `talos` group, or a `go.work`
covering both modules — is recorded in `.github/dependabot.yaml` with its reasoning, as the existing
group comments already are.

Rough size: **S**. Independent of #6728's upstream wall; fixable now.

Part of the same dependency line as #6728.

Start with .github/dependabot.yaml and compare root go.mod/go.sum with desktop/go.mod/desktop/go.sum, then review the grouped update evidence from #6813 and its Linux build job. Verify the chosen configuration with a grouped gomod update: both module lockfiles should change, and a #6813-shaped PR should reach dependency incompatibility rather than report that go.mod needs updates.

Written by the indexing model from the issue text.