fix(ci): since #6851, every root gomod bump the desktop module shares lands permanently red on a required check

> 🤖 Generated by the Agentic Engineer

## Evidence

Since #6851 merged (2026-09-03 09:45Z), CI no longer pushes the desktop-module tidy onto Dependabot branches, so Dependabot keeps its rebase ability. But every root `gomod` bump that touches a dependency the desktop module shares now lands **permanently red on a required check**, and nothing repairs it.

Measured on the three gomod bumps Dependabot rebased at 17:15Z today, all with auto-merge armed:

| PR | bump | `🧪 Test` (required via the Go pipeline) | `🧩 Desktop App` build |
|---|---|---|---|
| #6859 | `sigs.k8s.io/kind` 0.32.0 → 0.33.0 | FAIL — `TestClaircoreLinkedPackagesStayInert/desktop`: `go: updates to go.mod needed` | FAIL, same error |
| #6860 | `google.golang.org/grpc` 1.83.1 → 1.83.2 | FAIL, same subtest | FAIL |
| #6861 | `github.com/kubescape/opa-utils` 0.0.308 → 0.0.312 | FAIL, same subtest | FAIL |

On each run the `🧩 Verify Desktop Module Tidy` job **did** detect the drift and uploaded a non-empty `desktop-tidy-patch` (869 B on #6859), and `📤 Auto-Commit Generated Changes` applied it — then its push step was **skipped** by the new `user.login != 'dependabot[bot]'` condition, exactly as #6851 intended. All three deps are `// indirect` requirements in `desktop/go.mod`, so the stale pin is in the desktop module, which the root bump cannot touch.

## Why the #6851 design cannot land these

#6851 relied on the generated changes reaching `main` through the post-merge sync PR. That path is unreachable here: the desktop drift fails `TestClaircoreLinkedPackagesStayInert/desktop` **inside the required `🧪 Test` job before the merge**, so the bump never merges and the post-merge sync never runs. #6832's stall (stuck after any sibling merge, ~half of PRs) has become a stall on **every** shared-dependency bump, on arrival.

## Impact

The gomod ecosystem cannot land any bump that the desktop module shares — which is most of them, since `desktop/go.mod` mirrors the root graph — without an agent pushing a tidy commit (which in turn forfeits Dependabot's rebase, the #6832 problem). The open-PR cap fills with red bumps and dependency intake throttles, the same shape #6819 describes.

## Expected behaviour

A root gomod bump of a dependency shared with `desktop/` reaches merge with no agent commit, and Dependabot keeps ownership of its branch throughout. That is #6189's acceptance criterion; this issue records that #6851 made #6189 the blocking path rather than a convenience.

## Options

1. **Bring `desktop/` under Dependabot in the same PR** — `directories: ["/", "/desktop"]` with `group-by: dependency-name` so one PR carries both modules (#6189's first option). Open question to measure on a real bump: whether Dependabot updates the desktop module's `// indirect` pin for a dependency that is direct only at the root. If it does not, this option needs `allow: dependency-type: all`, which would also bump the root's hundreds of indirect pins and violate #6189's noise guardrail.
2. **Restore the sync push and make staleness self-healing** — #6832's option 2: keep pushing the tidy onto the Dependabot branch and standardise on `@dependabot recreate` when it goes stale. Needs a measurement that a recreate command posted by the repository's App is honoured by Dependabot.
3. **Make the desktop module not need lockstep** — a root `go.work` so both modules resolve one build list. Touches the release build (`GOWORK`), so it is the largest change.

## Acceptance criteria

- [ ] A root gomod bump of a dependency that `desktop/go.mod` pins as `// indirect` opens with `🧪 Test` green and no agent commit on the branch (observed on a real bump, not reasoned).
- [ ] Dependabot can still rebase that PR after `main` moves.
- [ ] #6859, #6860 and #6861 (or their recreated successors) reach merge.

Rough size: S for option 1 (config + observation), M for 2, L for 3.

Part of #6819. Related: #6189 (root cause), #6832 / #6851 (the change that made it blocking).

Start with the 🧩 Verify Desktop Module Tidy and 📤 Auto-Commit Generated Changes jobs, then inspect desktop/go.mod and the root and desktop Dependabot configuration. Reproduce the failure from #6859, #6860, or #6861 and verify that a shared root dependency bump passes 🧪 Test without an agent commit while Dependabot can still rebase the PR.

Written by the indexing model from the issue text.