Docker CLI pinned below its patched version by a replace directive

> 🤖 Generated by the Agentic Engineer

### Evidence

`go.mod` and `desktop/go.mod` both carry a `replace` directive pinning the Docker CLI library down to a version that a published advisory lists as affected:

```
github.com/docker/cli => github.com/docker/cli v28.3.1+incompatible
```

The `require` line resolves to a current release, so the vulnerable version is visible only in the `replace` block — dependency dashboards that read `require` lines report this module as up to date. CodeRabbit's OSV scanner surfaced it on an unrelated dependency-bump PR (#6839), where it is out of diff.

The advisory is **CVE-2025-15558** (GHSA-p436-gjf2-799p): an uncontrolled search path for CLI plugins on Windows allows a low-privileged local user to plant a binary that the Docker CLI then executes. Fixed upstream in **v29.2.0**.

### Affected audience and impact

**Assessed not reachable in KSail's build**, so this is a supply-chain-scanner exposure rather than an exploitable path today:

- The module is `// indirect` in both modules — no KSail package imports it.
- The vulnerable code is the CLI plugin manager. KSail's Docker integration imports `github.com/docker/docker/client`, not `github.com/docker/cli`, and the repository contains no reference to the plugin-search path.

The cost while it stands is real but bounded: every vulnerability scan on this repository reports a Major finding that has to be re-triaged by hand, on every dependency PR that touches `go.mod`. That recurring triage is the actual impact.

### Why it cannot simply be bumped

The pin is deliberate and documented in-file. Docker CLI v29 migrated to the split `moby/moby/api` + `moby/moby/client` modules, whose types are incompatible with the `docker/docker` monolith types that k3d still uses. Pinning to v28 keeps the whole dependency graph on one type system; moving to v29.2.0+ breaks the build.

**Blocker:** k3d-io/k3d v5.9.0 | last-verified 2026-09-05: not shipped — v5.9.0 is still the latest release (checked via the Go module proxy) and still uses the `docker/docker` monolith types, so no upstream version exists that would let the pin move.

### Expected behaviour

The effective Docker CLI version in both modules is at or above the patched release, with no `replace` override holding it below.

### Acceptance criteria

- [ ] The `github.com/docker/cli` `replace` directive is removed from `go.mod` and `desktop/go.mod`, or repointed at a version at or above the patched release.
- [ ] Both modules build and the full test suite passes with the monolith/split type systems reconciled.
- [ ] A vulnerability scan of the repository reports no finding for this advisory.
- [ ] The in-file comment explaining the pin is removed along with it.

### Rough size

Small once k3d moves; not startable before then. Re-check the blocker on each triage pass and unblock as soon as a k3d release drops the monolith types.

Start by rechecking the k3d release blocker described in the issue, then inspect the replace directives and comments in go.mod and desktop/go.mod. Once compatible k3d support exists, remove or update the Docker CLI pins, build both modules, run the full test suite, and verify the vulnerability scan no longer reports CVE-2025-15558.

Written by the indexing model from the issue text.