The `bootstrap` target ran `go get -u google.golang.org/grpc@v1.59.0`,
pinning grpc to v1.59.0. That pin was added in #367 when grpc was at
v1.59.0 and never updated after go.mod moved to v1.82.1. Because
`bootstrap` is a prerequisite of `generate`/`pipeline`, running either
target downgrades the module's grpc back to v1.59.0 (re-introducing
already-remediated CVEs) and `gen.sh`'s trailing `go mod tidy` persists
the downgrade into go.mod/go.sum.

Proto generation does not need the grpc module fetched: rpc/gen_proto.sh
emits code via `--go_out=plugins=grpc:`, whose grpc plugin ships inside
protoc-gen-go@v1.3.2. The grpc runtime version is governed entirely by
go.mod. Removing the line leaves bootstrap installing only protoc-gen-go
and keeps grpc at the go.mod-selected v1.82.1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4a902de7-e15e-494c-b590-1f9e94a5fadd