build(deps): refresh Go 1.26 patch and container pins

.github/workflows/ci.yml

@@ -39,6 +39,7 @@ jobs:
         run: node scripts/verify.mjs --section proto
 
   go:
+    # Keep this context name stable until the main ruleset is migrated.
     name: Go 1.26.6
     runs-on: ubuntu-24.04
     timeout-minutes: 30
@@ -53,7 +54,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.6
+          go-version: 1.26.8
           check-latest: false
           cache: true
       - name: Verify format, modules, tests, race detector, vet, build, staticcheck, and vulnerabilities
@@ -122,7 +123,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.6
+          go-version: 1.26.8
           check-latest: false
           cache: true
       - name: Install JavaScript workspaces reproducibly

.github/workflows/release.yml

@@ -38,7 +38,7 @@ permissions:
 
 env:
   CI: "1"
-  GO_VERSION: 1.26.6
+  GO_VERSION: 1.26.8
   # Required status-check contexts on the `main` ruleset. Keep in sync with
   # GOVERNANCE.md and the job names in ci.yml, codeql.yml, and gitleaks.yml.
   REQUIRED_CONTEXTS: |

deploy/docker/core.Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
-FROM golang:1.26.6-bookworm@sha256:116d58cbd88c1297624acc6e967a060012422bacf9930927e23fb719189c6f36 AS build
+FROM golang:1.26.8-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d AS build
 
 WORKDIR /src
 COPY go.mod go.sum* ./
@@ -14,7 +14,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     install -d -m 0700 -o 65532 -g 65532 /image-data/var/lib/antiflock && \
     test "$(stat -c '%u:%g:%a' /image-data/var/lib/antiflock)" = "65532:65532:700"
 
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
 
 COPY --from=build --chown=65532:65532 /out/ /usr/local/bin/
 COPY --from=build --chown=65532:65532 /image-data/var/lib/antiflock/ /var/lib/antiflock/

docs/release-policy.md

@@ -74,7 +74,7 @@ Each release produces, for `linux/amd64` and `linux/arm64`:
 | `SHA256SUMS.provenance.sigstore.json`      | cosign attestation bundle (SLSA v1 provenance predicate) over `SHA256SUMS` |
 
 Build flags: `CGO_ENABLED=0 go build -trimpath -buildvcs=true -ldflags="-s -w"`,
-Go `1.26.6` (the same version as the `Go 1.26.6` required check). The
+Go `1.26.8` (the same toolchain used by the required Go check). The
 workflow refuses to build from a dirty tree so `vcs.modified` is always
 `false` in a release binary. `antiflock-sim` and the container image are not
 release artifacts in this policy revision; the image remains a lab/dev

docs/supply-chain.md

@@ -8,7 +8,7 @@ this is the inventory.
 
 | Input                        | Control                                                                 |
 | ---------------------------- | ----------------------------------------------------------------------- |
-| Go modules (`go.mod`, `go.sum`) | `go mod tidy -diff` and `govulncheck` in the `Go 1.26.6` required check; new modules need maintainer sign-off in the pull request; Dependabot group `go-dependencies` weekly |
+| Go modules (`go.mod`, `go.sum`) | `go mod tidy -diff` and `govulncheck` in the required Go check; new modules need maintainer sign-off in the pull request; Dependabot group `go-dependencies` weekly |
 | npm workspaces (`apps/web`, `apps/aether-demo`, `sdk/typescript`) | lockfiles required (`scripts/install-js.mjs` installs with `npm ci`); Dependabot one group per workspace; there is no root npm entry because the root has no lockfile |
 | GitHub Actions               | every `uses:` pinned to a full commit SHA with a `# vX.Y.Z` comment; Dependabot group `actions` weekly; `dependency-review.yml` reviews every pull request for vulnerable or disallowed-license additions |
 | Container base images        | `deploy/docker/core.Dockerfile` pins `golang` and `distroless` by digest; Dependabot `docker` entry weekly |
@@ -23,7 +23,7 @@ Dependabot PR is not auto-merged.
 Release binaries are built by `.github/workflows/release.yml` on GitHub-hosted
 `ubuntu-24.04` runners with:
 
-- Go `1.26.6`, the same toolchain as the required `Go 1.26.6` check;
+- Go `1.26.8`, the same toolchain as the required Go check;
 - `CGO_ENABLED=0`, `-trimpath`, `-buildvcs=true`, `-ldflags="-s -w"`;
 - a clean checkout of the exact tagged commit (the workflow refuses a dirty
   tree).

scripts/tooling.mjs

@@ -14,8 +14,8 @@ import { fileURLToPath } from "node:url";
 export const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 export const versions = Object.freeze({
-  go: "1.26.6",
-  goImage: "golang:1.26.6-bookworm@sha256:116d58cbd88c1297624acc6e967a060012422bacf9930927e23fb719189c6f36",
+  go: "1.26.8",
+  goImage: "golang:1.26.8-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d",
   node: "24.18.0",
   buf: "1.72.0",
   bufImage: "bufbuild/buf:1.72.0@sha256:65bd496a89c762ad7151ca9e7d885a45dacb3671a8e8ec39738b9f844d3405ea",