docs: address review feedback on bump-deps

- DefaultPorts godoc: spell out that mutating the exported map is only
  safe during package initialization / before concurrent use, since it
  is a plain Go map with no locking.
- CI env comment: the go.mod here has no toolchain directive, so
  rephrase GOTOOLCHAIN=local's rationale in terms of Go's automatic
  toolchain download behavior in general.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dunglas

.github/workflows/ci.yaml

@@ -5,9 +5,9 @@ on:
   pull_request:
 
 env:
-  # Pin to the toolchain set up by actions/setup-go so Go does not silently
-  # download a newer one based on the go.mod toolchain directive — that
-  # would defeat the oldstable matrix entry.
+  # Pin to the toolchain set up by actions/setup-go so Go does not
+  # download or switch to a newer one automatically — that would defeat
+  # the oldstable matrix entry.
   GOTOOLCHAIN: local
 
 jobs:

parser.go

@@ -14,10 +14,14 @@ import (
 // https://urlpattern.spec.whatwg.org/#full-wildcard-regexp-value
 const fullWildcardRegexpValue = ".*"
 
-// DefaultPorts maps a protocol scheme to its default port string. It is
-// exported so callers can register additional schemes, but this is an
-// experimental affordance and the symbol may change or be removed in a
-// future release.
+// DefaultPorts maps a protocol scheme to its default port string.
+//
+// Callers may add entries for additional schemes, but only during program
+// initialization and before any concurrent use of this package: as with
+// any Go map, concurrent read/write is not safe.
+//
+// This is an experimental affordance and the symbol may change or be
+// removed in a future release.
 //
 // TODO: there is nothing in the Go stdlib to find the default port
 // associated with a protocol. Only the specialSchemeSet entries are