release: bump Go toolchain 1.26.4 → 1.26.5 to clear the GO-2026-5856 CVE gate (only red on dev)

[gnanirahulnutakki]

Context / Problem

The Go CVE scan job (govulncheck ./...) is the only red check on dev. It fires because the Go toolchain is pinned to 1.26.4, which is affected by the standard-library advisory GO-2026-5856. This vuln is in the Go stdlib, so it can only be cleared by bumping the toolchain to 1.26.5 — a dependency bump (dependabot) cannot fix a stdlib vuln. Until this is green, PR #17 (dev→main) cannot merge under branch protection.

Evidence

• go/go.mod:3 → go 1.26.4
• .github/workflows/tests.yml — go-version: '1.26.4' at L44, L111, L133; the CVE job is go-cve / "Go CVE scan" (L123–143) running govulncheck ./... (L143). Each pin carries the comment # Must match the go directive in go/go.mod (currently 1.26.4).
• .github/workflows/kernel-enforce.yml — go-version: "1.26.4" at L136, L193, L334.
• Mirror copies exist and must stay in sync: site/static/repo/.github/workflows/tests.yml and site/static/repo/.github/workflows/kernel-enforce.yml.
• main is on go 1.25.9; dev on 1.26.4 — bumping to 1.26.5 keeps dev ahead.
• Related: [B] Make the Go CVE gate blocking (bump go 1.26.4 + golang.org/x/net, remove continue-on-error) #76 (make the CVE gate blocking — the gate itself is already blocking via merged ci: make go-cve gate blocking (remove continue-on-error) #84/ci(go): add govulncheck CVE gate — fix #45 (SAFE) #54), and open dependabot PRs deps(go)(deps): bump github.com/cilium/ebpf from 0.21.0 to 0.22.0 in /go #133 (cilium/ebpf) / deps(go)(deps): bump github.com/spiffe/go-spiffe/v2 from 2.6.0 to 2.8.1 in /go #134 (go-spiffe) which will not clear this stdlib advisory.

What to do / Acceptance criteria

1. Bump the go directive in go/go.mod from 1.26.4 → 1.26.5.
2. Update every go-version pin to 1.26.5: tests.yml (L44/L111/L133), kernel-enforce.yml (L136/L193/L334), and the site/static/repo/.github/workflows/ mirrors.
3. Update the "currently 1.26.4" comments to say 1.26.5.
4. Acceptance: the Go CVE scan job (govulncheck ./...) passes green on dev; go build ./... and go test ./... still pass; the site-mirror workflows match the real ones (no drift).

[gnanirahulnutakki]

Implementation is ready for human review in PR #183.

All GitHub checks are green, including the Go CVE scan, hosted KVM kernel smoke, seccomp smoke, full seccomp enforcement E2E, Python 3.10/3.13, CodeQL, and published-site validation. No merge action was taken.