deps: bump Go toolchain — 8 stdlib CVEs flagged by gopls vulncheck

[pskry]

gopls go_vulncheck on 2026-05-10 (Go 1.26.2) flagged 8 stdlib
vulnerabilities. All are Go runtime-side; the fix is bumping the
toolchain.

Findings

ID	Affected	Summary
GO-2026-4918	net/http	HTTP/2 SETTINGS_MAX_FRAME_SIZE=0 → infinite CONTINUATION write loop
GO-2026-4971	net	Dial/LookupPort panic on Windows with NUL input
GO-2026-4976	stdlib	ReverseProxy forwards extra query params past Rewrite
GO-2026-4977	stdlib	consumePhrase DoS on RFC-5322 email parse
GO-2026-4980	html/template	Empty/whitespace type= in <script> mis-escapes
GO-2026-4981	net	cgo DNS LookupCNAME double-free on long CNAME
GO-2026-4982	html/template	URL escape bypass via whitespace around = in <meta content=>
GO-2026-4986	stdlib	ParseAddress/ParseAddressList/ParseDate CPU+mem exhaustion

Fix shape

Bump go.mod's go directive and the toolchain (CI matrix,
docs, install instructions) to the latest patched Go release
that addresses these CVEs. Rerun gopls go_vulncheck to
confirm the findings are gone.

Acceptance

• go.mod bumped.
• CI uses the new Go version.
• gopls go_vulncheck clean.

Source: review-2026-05-10.md vulncheck addendum.

[pskry]

Already resolved — the toolchain was bumped to Go 1.26.4 after this was filed (findings were on 1.26.2), most likely via the go-minor-patch dependabot group (#435).

Verified:

• go.mod: toolchain go1.26.4
• CI: .mise.toml pins go = "1.26.4" (CI provisions Go via jdx/mise-action)
• govulncheck ./... on 1.26.4: No vulnerabilities found — all 8 GO-2026-49xx findings are gone
• No stale Go version in README/CONTRIBUTING/site docs/install instructions

Nothing to change; closing.