Bump toolhive-core to v0.0.47

[reyortiz3]

Summary

• Upgrades github.com/stacklok/toolhive-core from v0.0.43 to v0.0.47.
• v0.0.46 was initially skipped: its redis package referenced PoolSize/MaxActiveConns fields on redisconn.Config that weren't present in the published redisconn submodule (stuck at v0.0.1), so it failed to build. That was an upstream release-process bug — the redisconn submodule's tag was never cut when those fields were added.
• The upstream bug has since been fixed (redisconn/v0.0.2 was tagged, root go.mod pins were corrected), and stacklok/toolhive-core cut a new v0.0.47 release with everything consistent. This PR bumps straight to that release.
• Also opened a fix upstream (Detect stale nested-module pins before release toolhive-core#294) that adds a release-preflight check to catch this exact class of bug (a nested-module pin going stale relative to its actual tagged content) before it ships again.
• go mod tidy also promoted several transitive dependencies (e.g. sigstore/cosign signing, additional otel packages) to direct requires as a result of the newer toolhive-core version.
• v0.0.47 marks the old toolhive-core/redis package as a deprecated compatibility facade for redisconn (part of the same extraction work above). That surfaced 6 staticcheck SA1019 failures across pkg/authserver, pkg/transport/session, pkg/vmcp/server, and pkg/runner. Migrated all call sites (12 files) from redis.Config/redis.NewClient to redisconn.Config/redisconn.NewClient directly — a straight rename with no behavior change, since redisconn.Config is a field-for-field superset of the old Config and none of these call sites use cloud IAM auth (DynamicAuth).
• Regenerated swagger docs and the Go SDK client: toolhive-core v0.0.47 adds a plugin provenance field to registry/types, which flows into the generated skill schema.

Type of change

• Dependency update

Test plan

• Unit tests (task test)
• Linting (task lint) — 0 issues
• Verified toolhive-core@v0.0.47's redis package builds cleanly in an isolated module (go build against the real published module, not a local replace)
• task docs regenerates cleanly with no diff (swagger/SDK now match)

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Does this introduce a user-facing change?

No.

Special notes for reviewers

• The redis → redisconn migration is mechanical (import path + 4 renamed symbols: Config, NewClient, SentinelConfig, TLSConfig), verified against redis.Config's own translation method in the deprecated facade to confirm the field mapping is 1:1.
• Two commits: one for the swagger/SDK regen, one for the redisconn migration, to keep the diff easy to review separately from the version bump itself.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 78.57143% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.91%. Comparing base (41dec70) to head (6817771).

Files with missing lines	Patch %	Lines
pkg/authserver/runner/embeddedauthserver.go	77.77%	2 Missing ⚠️
pkg/runner/runner.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6646      +/-   ##
==========================================
- Coverage   78.98%   78.91%   -0.07%     
==========================================
  Files         782      782              
  Lines       78067    78067              
==========================================
- Hits        61660    61606      -54     
- Misses      16402    16456      +54     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.