Bump Go to 1.26.6

[fredericsun]

Summary

Upgrade the project Go toolchain from 1.26.5 to 1.26.6.

Root cause

The post-merge CI run for #187 failed in Vulnerability Scan after govulncheck began reporting six Go standard-library vulnerabilities affecting Go 1.26.5. All reported vulnerabilities are fixed in Go 1.26.6.

This failure was unrelated to the functional changes in #187.

Changes

• Upgrade the Go version in go.mod.
• Upgrade the Docker builder image to Go 1.26.6.
• Synchronize the minimal-image test fixture.
• Update contributor documentation with the new minimum Go version.

Validation

• make vulncheck — no vulnerabilities found
• make ci — passed
• make build — passed
• bash hack/verify-minimal-images_test.sh — passed

[github-actions]

Codex review

Files reviewed

Root:

• [reviewed] CONTRIBUTING.md
• [reviewed] go.mod

dockerfiles/:

• [reviewed] dockerfiles/Dockerfile

hack/:

• [reviewed] hack/verify-minimal-images_test.sh

site/content/en/docs/developer-guide/:

• [reviewed] site/content/en/docs/developer-guide/contributing.md

Findings

Blocking

None.

Should-fix

None.

Nit

None.

Per-category coverage

1. Vendor-neutral naming: Clean
2. Contract & spec / docs sync: Clean
3. gRPC fail-open semantics: Clean
4. Quality (tests / error wrapping / package placement / generated drift): Clean

Verdict

approve

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!