fix(build): pin Go toolchain to 1.26.6 for standard-library CVE fixes

Builds used the go1.26.5 toolchain, whose standard library contained seven vulnerabilities that govulncheck reported as reachable (GO-2026-6218, GO-2026-6091, GO-2026-6090, GO-2026-6089, GO-2026-6088, GO-2026-5972, GO-2026-5026). This change pins the module toolchain to go1.26.6 and sets the CI Go version to 1.26.6, so every build compiles against the patched standard library. After the bump govulncheck reports zero vulnerabilities affecting the code. The go language directive stays at 1.25.0, so no language behaviour changes.

.github/workflows/autoupdate.yaml

@@ -14,6 +14,6 @@ jobs:
   autoupdate:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
     with:
-      go-version: ">=1.24"
+      go-version: ">=1.26.6"
       release-workflow: "release.yaml"
     secrets: inherit

.github/workflows/pr.yaml

@@ -13,4 +13,4 @@ jobs:
   pr-checks:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-pr.yaml@main
     with:
-      go-version: "1.24"
+      go-version: "1.26.6"

.github/workflows/release.yaml

@@ -21,7 +21,7 @@ jobs:
   release:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
     with:
-      go-version: "1.25"
+      go-version: "1.26.6"
       docker-enabled: true
     secrets: inherit
 
@@ -39,7 +39,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.25"
+          go-version: "1.26.6"
 
       - name: Run benchmarks
         run: go test -bench=. -benchmem ./... -run=^# | tee output.txt