[stackstate-agent] Bump klauspost/compress to v1.18.7 and refresh expired agent CVE exceptions

[ai-collaboration-app]

The agent image scan still reports GO-2026-5841 against both agent images, and its
exception expired on 2026-08-20.

GO-2026-5841 [UNKNOWN] pkg:golang/github.com/klauspost/compress@v1.18.5
  quay.io/stackstate/stackstate-k8s-agent:9516cb41
  quay.io/stackstate/stackstate-k8s-cluster-agent:9516cb41

This one is a straight patch bump

GO-2026-5841 is an out-of-bounds read in github.com/klauspost/compress/s2,
introduced in 1.16.0 and fixed in 1.18.7, which is published. The default
branch still pins v1.18.5 in 20 go.mod files (the root module plus the
comp/otelcol/*, pkg/* and test/* submodules). The existing exception
already records that v1.18.7 is the fix and that it needs a go.mod update
rather than a direct pin.

Scope

• Bump github.com/klauspost/compress to v1.18.7 and re-sync the workspace.
• Drop exceptions/stackstate-k8s-agent/GO-2026-5841.yaml and
  exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml — with the fix in
  source they would otherwise suppress a regression.
• Refresh the remaining in-batch exceptions that expired on 2026-08-20
  (cryptography, golang.org/x/crypto) and drop
  exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml, which the merged
  embedded-Python 3.13.15 bump (Remediate Go and embedded Python CVEs #463) already fixes.

Out of scope

• openssl CVE-2026-14456 — no released upstream fix; tracked in [stackstate-agent] CVE-2026-14456 (openssl 3.5.7) — no upstream fix published, needs a tracked exception #489.
• cryptography 48.0.1 → 50.0.0 — blocked on the integrations tag; tracked in [STAC-25515] [stackstate-agent] Consume fixed cryptography and publish agent images #484.
• The eight pkg:generic/python@3.13.13 exceptions that also expired on
  2026-08-20 need their own review pass; noted in [stackstate-agent] CVE-2026-14456 (openssl 3.5.7) — no upstream fix published, needs a tracked exception #489.

Batch context: StackVista/cve-reporter#29.