[jakezwang]

The active benchmark dependency and CI recipe still used Argon 2.1.2, Go 1.26.6 and MongoDB 7.0.43 after the security maintenance update. Use Argon 2.1.3, Go 1.26.9 and the official MongoDB 7.0.45 image; pin both build/database images by immutable digest and check the actual Go version in generated provenance.

Update current run examples while preserving the v2.1.2+ compatibility boundary, historical reports, archived raw data and RESULTS.md. There are no measurement algorithm changes or new performance claims.

Validation:

• Go unit tests and build pass with GOTOOLCHAIN=go1.26.9; govulncheck reports zero reachable vulnerabilities (uncalled dependency advisories remain).
• actionlint, Compose configuration and the clean committed Docker build pass.
• A real disposable Compose replica-set smoke passes: 100 documents, one worker, one ancestry level, two samples and exactly six captured updates. The report records clean engine a06ae0870afca1ee83ae7c059f41f5cb0d898932 (v2.1.3), clean suite 08907ad, Go 1.26.9 and MongoDB 7.0.45. Fixture databases and containers were removed afterward.
• Historical reports and RESULTS.md are unchanged. This smoke verifies correctness, not performance or an SLA.