make generate now runs the codegen version go.mod requires, so bring
api/lf.go up to it rather than leave the next regeneration to carry the
generator bump alongside an unrelated spec change. Same spec,
v5.0.1-stable; the diff is the generator's: Valid() methods on enums,
fuller doc comments and reworked query parameter encoding. The unused
Api_keyScopes constant is gone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

--filter only looked at the message, but round numbers and peer and
account addresses are written as fields, and they are what people search
for. `--filter 49291042` found nothing on the entry rendered with
Round=49291042.

The search now covers each field Render prints, matched as decoded,
unquoted key=value text, so the value, the key or the pair all match. A
value Render quotes is searched without its quotes. Hidden fields stay
out: "function" names the Go package, and matching it would keep a line
for a reason the line does not show. Render and Keep share one test of
what is shown, so the two cannot drift.

The prescreen stays one-sided. The line writes a pair as "Round":49291042,
so the text is split at each "=" and every part is required on its own.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The comment claimed the generator was "pinned in go.mod" while the
recipe ran oapi-codegen@v2.4.1 against a go.mod requiring v2.8.0. `go
run pkg@version` ignores the module's requirements entirely, so the two
were free to drift, and had: the next `go get -u` would bump the library
the generated code is compiled against while `make generate` kept
emitting v2.4.1 output.

The version now comes from `go list -m`, so the claim holds by
construction and a library bump carries the generator with it. Left as
`go run pkg@version` rather than a go.mod `tool` directive on purpose:
the directive pulls the generator's own dependency graph into this
module, which cost twelve indirect requirements and a bump to
rogpeppe/go-internal for a tool nothing in the build imports.

Recursively expanded, so the query runs for `make generate` and not for
`make build` or `make test`, and guarded so an unresolvable version says
so rather than running `oapi-codegen@`.

Note that api/lf.go is still v2.4.1 output, so the next `make generate`
will carry a generator bump alongside whatever the spec changed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RrRQEXGWtmBskmUbiZbRi1

The GitHub REST API allows 60 unauthenticated requests an hour per IP,
which shared CI runners exhaust, and the lookup then fails with the
generic "could not resolve" error. git ls-remote has no such limit, no
per_page cap and needs no JSON scraping.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

feat: add nodekit restart

fix: show date only for expirations over one week away

Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/compare/v6.0.3...v7.0.2)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump the security-patches group across 1 directory with 2 updates