build(security): pin Go toolchain to 1.26.5 + add blocking govulncheck CI job (om-xga8)

govulncheck flags GO-2026-5856 (CVE-2026-42505, ECH privacy leak in
crypto/tls, fixed in go1.26.5) against the 1.26.4 toolchain. It is
symbol-reachable here (internal/spot -> net/http -> https -> tls), so the
scanner genuinely reports it; real exposure is ~nil (we never configure ECH).
An unclean scanner is a scanner nobody reads, so: get to a clean baseline and
wire govulncheck into CI so the next advisory arrives as a red check.

- go.mod: ADD `toolchain go1.26.5` (a soft floor). The `go 1.26.4` line
  STAYS — it is the minimum-LANGUAGE-version contract, not the build-stdlib
  selector. Bumping it would hard-break GOTOOLCHAIN=local builders (distro
  packagers, hermetic/air-gapped) for zero security gain. The toolchain
  directive gives patched stdlib under GOTOOLCHAIN=auto while local 1.26.4
  builds still succeed. go.sum untouched.
- ci.yml + release.yml: setup-go now reads `go-version-file: 'go.mod'`, so
  go.mod is the single source of truth for the toolchain — no floating '1.26'
  literal to silently roll, one place to bump next time.
- ci.yml: ADD a blocking `vuln` job running `govulncheck ./...` as its own
  job (a stdlib advisory shows as a distinct red check, not "your diff broke
  the build"). No Node/npm steps — `go build` works without the UI because
  web/dist/.gitkeep is tracked.

Verified: go1.26.5 selected under default GOTOOLCHAIN; build/vet/test pass;
govulncheck clean under 1.26.5; GOTOOLCHAIN=local build still succeeds on
1.26.4; go.sum unchanged.

Author: tompscanlan

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26'
+          go-version-file: 'go.mod'
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -28,3 +28,18 @@ jobs:
 
       - name: go test
         run: go test ./...
+
+  vuln:
+    # Blocking govulncheck. Its own job so a stdlib advisory shows up as a
+    # distinct red check, not "your diff broke the build". go build works with
+    # no UI (web/dist/.gitkeep is tracked), so no Node/npm steps are needed.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
           fetch-depth: 0 # tags, for `git describe`
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26'
+          go-version-file: 'go.mod'
       - uses: actions/setup-node@v6
         with:
           node-version: '22'

go.mod

@@ -2,6 +2,8 @@ module github.com/tompscanlan/coinrollhunter
 
 go 1.26.4
 
+toolchain go1.26.5
+
 require (
 	github.com/mattn/go-isatty v0.0.20
 	modernc.org/sqlite v1.53.0