build(deps): refresh Go 1.26 patch and container pins

[AetherAI3]

Outcome

Replaces the stale Docker-only Dependabot updates with one coordinated maintenance car:

• Go 1.26.6 → 1.26.8 in CI, release builds, local fallback tooling, and the builder image.
• Refreshes the pinned golang:1.26.8-bookworm digest.
• Refreshes the pinned distroless static-debian12:nonroot digest.
• Updates the release and supply-chain documentation.

Why this shape

Dependabot #74 proposed Go 1.27.0 only in the Dockerfile, which would split the repository's intentionally aligned toolchain and is already superseded by newer Go releases. This keeps the supported Go 1.26 line and takes its current security patch instead. The legacy Go 1.26.6 job context name is preserved because it is referenced by the main ruleset; only its actual toolchain moves to 1.26.8.

Verification

• git diff --check
• node --test scripts/dev-environment.test.mjs
• Full repository and container validation delegated to this PR's required CI (Docker is unavailable in the local runner).

Supersedes #45 and #74. Built from main after #93.