build(deps): bump go-runewidth and glamour, update nix vendorHash

[wesm]

Summary

• Cherry-pick go-runewidth 0.0.20 → 0.0.21 (build(deps): bump github.com/mattn/go-runewidth from 0.0.20 to 0.0.21 #489)
• Cherry-pick glamour 0.10.0 → 1.0.0 (build(deps): bump github.com/charmbracelet/glamour from 0.10.0 to 1.0.0 #490)
• Update flake.nix vendorHash for the new dependency set

Closes #489
Closes #490

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (f238934)

Verdict: One High severity issue identified regarding a breaking API change in the glamour v1.0.0 update.

High

• Files/Lines: go.mod:9, cmd/roborev/tui/helpers.go:10, cmd/roborev /tui/tui.go:16, internal/streamfmt/render.go:8, internal/streamfmt/streamfmt.go:12
  The glamour bump is a semver-major upgrade, but the code still imports github.com/charm bracelet/glamour/ansi. In glamour v1.0.0, that package is no longer present in the module, which will break module resolution during go build and go test.
  Suggested fix: Either pin glamour to v0.10. 0 for now, or update the renderer code to the v1.0.0 API/package layout and verify with a full go test ./... and go build ./... pass.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[wesm]

False positive. merging