fix(deps): govulncheck red on every PR, bump klauspost/compress to v1.20.2 (GO-2026-6865) #562

Problem

The required check govulncheck has failed on every pull request to giantswarm/substrate since advisory GO-2026-6865 was published. The advisory is a panic in github.com/klauspost/compress v1.19.1 on frames made of two blocks, fixed in v1.20.2. Substrate reaches it through internal/benchmarking/glutton/service.go:284 (io.Copy). The giantswarm branch last scanned green on 2026-11-05 at e1355f2. The failure blocks every merge, starting with #561 (run https://github.com/giantswarm/substrate/actions/runs/42429469345).

Proposed solution

A fix(deps) PR on the giantswarm branch that bumps github.com/klauspost/compress to v1.20.2 or later: go.mod, go.sum and vendor/, plus its fork/ ledger file (a dependency bump of ours, upstream-ready if upstream still needs it). No ignore entry: a failed security scan is never bypassed.

Acceptance criteria

• govulncheck is green on the giantswarm branch and on fix(ateapi): take a lost golden again on the first resume #561 after it merges the base.

Filed by an agent (the lab's guide) from a worker's report.