[Benehiko]

Releases are no longer cut with the x/release helper, but it kept spf13/cobra and spf13/pflag in the go.mod of the x library module that every other module depends on.

This removes:

• x/release (the helper and its tests)
• docs/releasing.md, which only documented that helper
• the make bump target that ran it

Drops cobra, pflag and mousetrap from x/go.mod, and the vendored golang.org/x/mod/modfile, module and internal/lazyregexp packages that only the helper used. golang.org/x/mod stays in x only for the semver differential test in x/api added by #719. cobra stays in vendor/modules.txt because plugins/pass still uses it.

Builds for all workspace modules, go test ./x/... and golangci-lint on ./x/... pass. Tidied and vendored with make mod.

[docker-agent]

Assessment: 🟡 NEEDS ATTENTION

Two behavioral regressions introduced by replacing cobra with the standard flag package:

1. --help fails outside a git repository: the .git existence check runs before the flag.FlagSet is set up, so any invocation from a non-repo directory returns a misleading error instead of printing usage.
2. Flag-parse errors print twice: with flag.ContinueOnError, the flag package writes the error internally before returning it, and main prints it a second time. Suppressing the internal output with flags.SetOutput(io.Discard) would fix this.

The core rewrite (interspersed parsing, Level as flag.Value, go.mod cleanup) looks correct.