chore: bump to Go 1.26.7, pin builder image, record in CHANGELOG

Review caught that 1.26.6 was already superseded by 1.26.7 within its
minor line. Pin the Dockerfile builder to golang:1.26.7-alpine so the
shipped binary is built with the toolchain CI tests with (official
golang images set GOTOOLCHAIN=local, so a floating 1.26-alpine tag can
lag go.mod and hard-fail the release build). Record both changes under
[Unreleased].

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJnTGiMuTJSFUVRRqjfTbV

Author: stubbi

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Go toolchain bumped to 1.26.7 (from 1.26.5), clearing five stdlib vulnerabilities flagged by govulncheck (GO-2026-6218, GO-2026-6090, GO-2026-6089, GO-2026-5972, GO-2026-5026; all fixed by 1.26.6). The release image builder is pinned to `golang:1.26.7-alpine` so the shipped binary is built with the same toolchain CI tests with. Local builds now require Go >= 1.26.7.
+- `make vendor-core-crds` downloads the `sigs.k8s.io/karpenter` module before resolving its directory, fixing `generate` CI failures on any PR that changes `go.mod`/`go.sum` (cold module cache made `go list -m` return an empty dir).
+
 ## [2.1.0] - 2026-08-01
 
 ### Fixed

Dockerfile

@@ -1,6 +1,6 @@
 # Cross-compile from the native build platform to the target platform so multi-arch
 # builds don't run `go build` under slow QEMU emulation.
-FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine AS builder
 ARG TARGETOS
 ARG TARGETARCH
 WORKDIR /app

go.mod

@@ -1,6 +1,6 @@
 module github.com/paperclipinc/karpenter-provider-hetzner
 
-go 1.26.6
+go 1.26.7
 
 require (
 	github.com/awslabs/operatorpkg v0.0.0-20260708223819-4da4c353c5fa