fix: bump containerd to v1.7.33 for console-service CLI remediation

[plural-copilot]

Summary

• bump github.com/containerd/containerd from v1.7.32 to v1.7.33 in the root Go module
• refresh the matching go.sum entries only
• remediate the console-service vulnerabilities coming from the embedded plural CLI binary included in ghcr.io/pluralsh/console

Vulnerabilities addressed

• CVE-2026-53488 (github.com/containerd/containerd, high)
• CVE-2026-47262 (github.com/containerd/containerd, medium)

Validation

• confirmed the vulnerable indirect dependency pin in go.mod/go.sum
• ran go mod tidy in golang:1.26.4-bookworm and observed no additional file changes
• attempted targeted package tests in golang:1.26.4-bookworm for ./pkg/utils ./pkg/config ./pkg/console ./pkg/crypto ./pkg/api ./pkg/bundle ./pkg/pr ./pkg/up
• attempted docker build -f Dockerfile --target builder ., but Docker Hub metadata fetch for golang:1.26.4-alpine3.22 failed with an anonymous token/auth 404, so image-build validation could not complete in-session

Notes

• this is the smallest possible change to capture the fixed containerd version in module metadata
• CI should provide the final end-to-end confirmation

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create a PR in this repository to remediate the Go vulnerabilities affecting the console image via the embedded plural CLI binary....
🔗 Run history	View run history