build(deps): bump klauspost/cpuid to v2.3.0 for Go 1.27

[daeho-ro]

cpuid v2.0.4 reaches runtime.sched_getaffinity through //go:linkname in os_linux_arm64.go. Go 1.27 rewrote the linker's checkLinkname to drop the blanket ABI-wrapper exemption that previously allowed this, so linking any binary that pulls cpuid in now fails on linux/arm64:

# github.com/depot/cli/cmd/depot
link: github.com/klauspost/cpuid/v2: invalid reference to runtime.sched_getaffinity

cpuid removed the linkname in v2.2.3. It arrives here indirectly via moby/buildkit -> minio/sha256-simd, so bumping the existing indirect require is enough.

---

Note

Low Risk
Indirect dependency version bump only; no application logic, auth, or data-handling changes.

Overview
Bumps the indirect github.com/klauspost/cpuid/v2 require from v2.0.4 to v2.3.0.

Older cpuid used //go:linkname to runtime.sched_getaffinity on linux/arm64. Go 1.27 no longer allows that, so linking the CLI failed. v2.2.3+ dropped the linkname; this pin (pulled in via buildkit → minio/sha256-simd) is enough to restore builds.

^{Reviewed by Cursor Bugbot for commit 627f8a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kvnloo]

Checked live head 627f8a6 against main (still github.com/klauspost/cpuid/v2 v2.0.4 // indirect).

The stated failure is real: v2.0.4 os_linux_arm64.go pull-linknames runtime.sched_getaffinity. That was replaced with runtime.NumCPU() by v2.2.3, so the bump is the right fix for that symbol.

Two small things on this head:

1. go.sum still has the leftover github.com/klauspost/cpuid/v2 v2.0.4/go.mod line (the v2.0.4 h1 was dropped). go mod tidy should drop that leftover if v2.0.4 is no longer in the graph.

2. This repo is still go 1.25.0 / .tool-versions golang 1.25.14, and CI (lint/build/test) has not run on the PR — only Bugbot. Worth a maintainer-approved CI pass; the 1.27 linkname break will not show up on 1.25.

v2.3.0 still has //go:linkname hwcap internal/cpu.HWCap in os_unsafe_linux_arm64.go (!nounsafe). That one is handshake-whitelisted in stdlib (internal/cpu documents klauspost/cpuid), so it is not the same class of break as sched_getaffinity. Not a blocker.

Would merge after tidy + CI green.