chore(deps): Update oras.land/oras-go/v2

[simonbaird]

I noticed #3378 ignored tools/go.mod, so here's a change to update that one also.

Commit created like this:

hack/go-mod-upgrade-helper oras.land/oras-go/v2

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 12b41fee-f068-497a-a698-bc01476a9eee

📥 Commits

Reviewing files that changed from the base of the PR and between 449633a and a32a61a.

⛔ Files ignored due to path filters (1)

• tools/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• tools/go.mod

---

📝 Walkthrough

Walkthrough

This change updates the indirect dependency oras.land/oras-go/v2 in tools/go.mod from version v2.6.0 to v2.6.1.

Changes

Dependency Update

Layer / File(s)	Summary
Update indirect dependency version tools/go.mod	Bumped oras.land/oras-go/v2 from v2.6.0 to v2.6.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the dependency update in tools/go.mod.
Description check	✅ Passed	The description matches the change by noting the tools/go.mod update and the helper used.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	53.62% <ø> (ø)
generative	17.18% <ø> (ø)
integration	28.36% <ø> (ø)
unit	71.74% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:36 PM UTC · Completed 3:44 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

PR #3391 was a trivial 3-line dependency bump in tools/go.mod (oras.land/oras-go/v2 v2.6.0→v2.6.1), created as a manual follow-up to Renovate PR #3378 which missed the tools/ go.mod. The fullsend review agent failed at harness loading due to HTTP 429 rate limiting from raw.githubusercontent.com, so the PR merged with only human review (joejstuart approval) and CodeRabbit (no findings). The 429 failure is part of a broader pattern: 17 review failures in the recent period, at least 4 confirmed to be caused by the same transient 429 rate limiting on raw.githubusercontent.com resource fetches during harness loading. The harness resource fetcher lacks retry logic for transient HTTP errors, despite the shell-level fullsend binary downloader already having retry_curl with exponential backoff.

Proposals filed

• Add retry with backoff for transient HTTP errors (429, 502, 503) during harness resource fetching (in fullsend-ai/fullsend)
• Configure Renovate to update oras.land/oras-go/v2 consistently across all go.mod files including tools/go.mod (in conforma/cli)