Pins real released dependency versions (pilotprotocol v1.12.5, common v0.5.7) instead of the dev-replace-only v0.0.0, so consumers' module graphs resolve once cascade bumps strip dev replaces. Also refreshes stale indirect pins (rendezvous v0.2.5, trustedagents v0.2.4) whose old go.mods referenced the pre-rename module path.