fix: upgrade/uninstall hardening and security dependency bumps

[nullun]

ℹ Overview

Fixes prompted by a user report of nodekit upgrade failing on macOS with
"No available formula with the name algorand" for a node that was installed
with update.sh rather than Homebrew. Also includes the dependency bumps from
#187 so both changes ship in a single release.

Upgrade/uninstall fixes

• macOS: upgrade/uninstall now check whether algod is actually managed by
  Homebrew before running brew commands, and return a clear message pointing
  non-brew installs back to their original install method
• Linux: the same guard using dpkg -s / rpm -q before running apt/dnf
• nodekit upgrade now exits non-zero when the algod upgrade fails, instead
  of logging the error and exiting 0
• uninstall --force on macOS now passes each data directory to rm as a
  separate argument; previously they were space-joined into a single path and
  never deleted
• the self-upgrade debug log now prints the backup path instead of the temp
  path

Dependencies

• merges fix: bump dependencies #187 (dependency bumps), which will auto-close as merged
• bumps Go to 1.26.6 on top: govulncheck reports five reachable stdlib
  vulnerabilities in 1.26.5 (GO-2026-6218, -6090, -6088, -5972, -5026), all
  fixed in 1.26.6. The scan is clean after the bump.

Testing

• go build ./..., go vet, and the full test suite pass on the merged tree
• go mod verify and go mod tidy are clean
• govulncheck ./... reports zero reachable vulnerabilities

CI

• test workflows now derive the Go version from go.mod via go-version-file
  instead of pinning 1.22; builds previously relied on toolchain auto-download

[codecov]

Codecov Report

❌ Patch coverage is 35.71429% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 45.42%. Comparing base (bf1df43) to head (cd6f8ff).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/algod/linux/linux.go	33.33%	6 Missing and 2 partials ⚠️
internal/algod/mac/mac.go	42.85%	6 Missing and 2 partials ⚠️
cmd/upgrade.go	0.00%	1 Missing ⚠️
internal/system/upgrade.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #188      +/-   ##
==========================================
+ Coverage   36.15%   45.42%   +9.27%     
==========================================
  Files          96       96              
  Lines        6005     6025      +20     
==========================================
+ Hits         2171     2737     +566     
+ Misses       3681     3006     -675     
- Partials      153      282     +129     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR hardens nodekit upgrade/uninstall behavior to better handle nodes not installed via the package manager NodeKit expects (Homebrew on macOS, apt/dnf on Linux), while also rolling in dependency/security upgrades (including a Go version bump).

Changes:

• Add “package-manager managed?” guards for macOS (Homebrew) and Linux (dpkg/rpm) upgrade/uninstall flows, with clearer user-facing errors for non-managed installs.
• Make nodekit upgrade fail fast with a non-zero exit when the algod upgrade step fails.
• Bump Go and multiple Go module dependencies (per the merged dependency update work).

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/system/upgrade.go	Fixes self-upgrade debug log to reference the actual backup path.
internal/algod/mac/mac.go	Adds Homebrew-managed checks and fixes forced uninstall data-dir deletion argument handling.
internal/algod/linux/linux.go	Adds dpkg/rpm “managed install” checks before running apt/dnf operations.
cmd/upgrade.go	Ensures algod upgrade failures exit non-zero.
go.mod	Updates Go version and dependency versions.
go.sum	Updates module checksums to match dependency bumps.

Suppressed comments (1)

internal/algod/mac/mac.go:158

• trustTap() runs before the Homebrew-managed guard. On systems with Homebrew installed but algod not installed via the managed formula, nodekit upgrade will still execute brew trust ... before returning NotBrewInstalledMsg. Consider moving trustTap() to after the isBrewManaged() check to avoid unnecessary Homebrew side effects for non-brew installs.

	trustTap()

	if !isBrewManaged() {
		return errors.New(NotBrewInstalledMsg)
	}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tasosbit]

LGTM but leaving review to @PhearZero

I added a related UI task btw in case you want to add this too @nullun: #189