build(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 - #42

#427)

v0.9.1 carries the three fixes that followed the union release, two of them
against defects filed from this repo's review of v0.9.0:

  #40  PropagateScopes stands down when the root is absent, instead of
       stamping every unscoped dependency runtime -- the CLI calls it through
       detectorkit on every Python lockfile graph
  #41  a generic fallback identity keeps its ecosystem when reconstructed
       from the package URL alone
  #42  the component descriptor name is bounded

No golden moves: both behavioural fixes address shapes the fixtures do not
produce -- a caller holding a pre-promotion root ID, and a fallback identity
round-tripped through its purl. Verified with the full smoke suite, Python
cases included.

The release note in both guides described something the repository does not
do. It said draft releases are created automatically on merge to main, with
the bump chosen by commit prefix, so a `feat!:` squash title would make the
next release major. Nothing does that: Release fires only on a pushed
`v*.*.*` tag, and Auto Version is workflow_dispatch with the bump as an
explicit dropdown. The description now matches the workflows, and says
plainly that the bump is a decision someone makes rather than a consequence
of a commit title -- which is exactly the wrong conclusion the old text
invites.

Co-authored-by: Claude Opus 5 <[email protected]>