fix: Bump Go 1.26.1 to 1.26.2 for 6 stdlib CVEs (#2170)

* fix: Bump Go 1.26.1 to 1.26.2 to resolve 6 stdlib security vulnerabilities

Fixes GO-2026-4865 (html/template), GO-2026-4866 (crypto/x509),
GO-2026-4869 (archive/tar), GO-2026-4870 (crypto/tls),
GO-2026-4946 (crypto/x509), GO-2026-4947 (crypto/x509).

Updates go.mod, all Dockerfiles, and all CI workflow files.

* docs: Update Go version references in docs to 1.26.2

* fix: Update 16 service Dockerfiles to Go 1.26.2

* chore: Bump golangci-lint from v2.9.0 to v2.11.4

Aligns CI with Go 1.26.2 contextcheck behavior. v2.9.0 had stale
contextcheck heuristics that flagged existing nolint directives as
unused, while v2.11.4 correctly identifies them as necessary.

* fix: Resolve lint issues surfaced by Go 1.26.2 and golangci-lint v2.11.4

- Migrate proxy.Director to proxy.Rewrite (deprecated since Go 1.26)
- Use fmt.Fprintf instead of WriteString(fmt.Sprintf(...))
- Exclude noctx linter for test files (httptest.NewRequest creates a
  valid context; requiring WithContext in tests is noise)
- Remove now-unused nolint:noctx directive in bench test
- Add nolint:prealloc for defensive-copy test

* fix: Restore em dash in topic list output

Accidentally replaced the em dash with a hyphen during the
fmt.Fprintf refactor, breaking TestBuildTopicList_TopicsHaveDescriptions.

* fix: Address remaining lint and review feedback

- Use fmt.Fprintf in saga validation report (4 instances)
- Preserve Host header in proxy.Rewrite (SetURL overwrites it)

* fix: Create ReverseProxy directly with Rewrite instead of deprecated Director

Replace NewSingleHostReverseProxy + Director=nil with a direct
ReverseProxy struct literal using only the Rewrite field. This avoids
both the deprecated Director API and the mutual exclusivity error.
Preserves existing X-Forwarded-Host from incoming requests.

---------

Co-authored-by: Ben Coombs <bjcoombs@users.noreply.github.com>

Author: bjcoombs

.github/workflows/asyncapi.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up Node.js

.github/workflows/benchmarks.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf

.github/workflows/build.yml

@@ -53,7 +53,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf

.github/workflows/claude.yml

@@ -50,8 +50,8 @@ jobs:
             IMPORTANT: Today's date is ${{ steps.date.outputs.current_date }}.
 
             Key project facts:
-            - This project uses Go 1.26.1 (latest stable release)
-            - Go 1.26.1 is a valid version - do not question or flag it
+            - This project uses Go 1.26.2 (latest stable release)
+            - Go 1.26.2 is a valid version - do not question or flag it
             - Architecture: BIAN-compliant microservices
             - Stack: Go, Protocol Buffers, gRPC, Kubernetes
             - Security: All security scans must remain BLOCKING (never suggest making them non-blocking)

.github/workflows/codeql.yml

@@ -68,7 +68,7 @@ jobs:
       if: matrix.language == 'go'
       uses: actions/setup-go@v6
       with:
-        go-version: '1.26.1'
+        go-version: '1.26.2'
         cache: true
 
     # Set up buf for protobuf generation (pinned version for reproducibility)

.github/workflows/control-plane-ci.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf
@@ -80,7 +80,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf
@@ -117,7 +117,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf
@@ -163,7 +163,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf
@@ -207,7 +207,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf

.github/workflows/deploy-demo.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf

.github/workflows/deploy-develop.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf

.github/workflows/e2e.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Set up buf

.github/workflows/migrations.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Install Atlas CLI
@@ -82,7 +82,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.1'
+          go-version: '1.26.2'
           cache: true
 
       - name: Install Atlas CLI