[P1] Bump vulnerable deps: go-ethereum ≥1.17.0, grpc ≥1.83.1, x/net ≥0.60.0 (supersedes #30) #54

Priority: P1 (security) · Effort: S · Supersedes: #30

govulncheck ./... on the branch of #33 (ev-node v1.0.0 upgrade) reports 11 vulnerabilities in code paths it reaches:

#30 is not enough: it only reaches go-ethereum 1.16.8, which leaves GO-2026-4508 open.

Proposed fix

1. Merge fix(deps): upgrade ev-node to v1.0.0 and fix broken metrics #33 first. It rewrites go.mod and would conflict with chore(deps): bump github.com/ethereum/go-ethereum from 1.16.5 to 1.16.8 in the go_modules group across 1 directory #30.
2. Run go get github.com/ethereum/go-ethereum@v1.17.0 google.golang.org/grpc@v1.83.1 golang.org/x/net@v0.60.0 github.com/cometbft/cometbft@v0.38.21 && go mod tidy.
3. Close chore(deps): bump github.com/ethereum/go-ethereum from 1.16.5 to 1.16.8 in the go_modules group across 1 directory #30.
4. Add a govulncheck step to CI (tracked in [P3] Dockerfile: static non-root build; CI: run tests with -race #52).

Notes

ev-metrics is only a client of gRPC and EVM nodes, and it doesn't use go-ethereum's p2p stack, so several of these are low-impact in practice. The bump is still cheap and keeps scanners green.

Acceptance criteria

• govulncheck ./... reports only issues with no available fix.
• make test and make lint pass.