[dependabot:release-train-updater] Review-mode dependency update ready: grpc + pflag patch bump for github/gh-aw-mcpg

## Summary
A validated, low-risk Go dependency update is ready for review for target repository `github/gh-aw-mcpg` (this control-plane run is in `review` mode, so no PR was opened directly against the target).

**Action:** A maintainer with write access to `github/gh-aw-mcpg` should review the attached bundle and, if satisfied, apply the patch and open the PR manually (or re-run this workflow in `live` mode against that repo).

## What changed
- Ecosystem: Go
- Manifest(s): `go.mod`, `go.sum`
- Packages:
- `google.golang.org/grpc`: v1.83.1 → v1.83.2 (indirect, patch)
- `github.com/spf13/pflag`: v1.0.9 → v1.0.10 (indirect, patch)
- Update type: patch / routine freshness

## Why now
Routine freshness scan found two transitive dependencies one patch release behind. `github/gh-aw-mcpg` has no `.github/dependabot.yml` yet. `govulncheck ./...` reported no vulnerabilities before or after the bump — this is not a security-driven update.

## Risk assessment
- Both dependencies are indirect (pulled via `modelcontextprotocol/go-sdk` and `spf13/cobra`).
- No auth/crypto/payment/serialization code touched.
- Patch-level bumps only, no known breaking changes.

Validation details

- `go build ./...` — success
- `make build` — success, produced `awmg` binary
- `go test ./...` — unit tests pass; integration tests require the `awmg` binary first (pre-existing repo behavior)
- `go test ./test/integration/...` after `make build` — all pass (47s)
- `govulncheck ./...` — No vulnerabilities found

Patch (go.mod / go.sum diff)

The full diff and a machine-readable review bundle (summary.md, changed-files.txt, changes.patch, validation.txt) were published as a workflow artifact via `publish_review_bundle` (bundle: `gh-aw-mcpg-go-deps`).

Smart-Dependabot-Merge-Candidate: yes

### Control Plane
- Correlation ID: `33873310314-39`
- Central repo: `githubnext/gh-aw-cao`
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33873310314
- Target repository (untrusted reference, not linked): `github/gh-aw-mcpg`

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33873695098) · copilot · auto · 46 AIC · ⌖ 13.6 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 12:49 PM UTC

Start with the published `gh-aw-mcpg-go-deps` review bundle and inspect the `go.mod` and `go.sum` diff for `github.com/gh-aw-mcpg`. Review the two indirect patch bumps, then run `go build ./...`, `make build`, `go test ./...`, and the integration tests after building; done means the patch is applied and the validations pass before opening a PR in the target repository.

Written by the indexing model from the issue text.