Hygiene: go.mod marks gopkg.in/yaml.v3 as indirect although it is a direct dependency

[LarsLaskowski]

Source: Full code review 2026-07-17 (docs/reviews/2026-07-17-full-code-review.md), finding F12.
Category: hygiene · Severity: low · Effort: trivial

Problem

go.mod:5 reads require gopkg.in/yaml.v3 v3.0.1 // indirect, but internal/config imports the package directly — the comment is stale.

Suggested fix

Run go mod tidy and commit the result. Optionally add a CI step that fails when go mod tidy produces a diff, so this can't drift again.