fix: bump Go to 1.26.5 for crypto/tls fix (GO-2026-5856)

[kevincodex1]

Summary

Bumps the Go toolchain from 1.26.4 to 1.26.5 to fix GO-2026-5856, an Encrypted
Client Hello privacy leak in the standard library's crypto/tls that was
failing CI's govulncheck job. Our code reaches the vulnerable paths through
normal TLS usage — the MCP OAuth callback server, dictation downloads, and the
daemon protocol/remote client — so any TLS use tripped it.

Since every workflow resolves the toolchain via go-version-file: go.mod,
bumping the go directive is the complete fix; no code changes needed.
Verified: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./... now reports
No vulnerabilities found (this also clears the second, uncalled dependency
finding from the failing run).

Checklist

• The linked issue already has the issue-approved label. (No linked issue — direct fix for the currently failing govulncheck CI job.)
• go build ./..., go vet ./..., and go test ./... pass locally.
• gofmt clean.
• Tests added/updated for the change (and run under -race where relevant). (N/A — toolchain version bump only, no code changed; full existing suite passes on 1.26.5.)
• UI changes include screenshots or a short recording where possible. (N/A — no UI changes.)

Summary by CodeRabbit

• Chores
  • Updated the Go runtime version to 1.26.5.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1d18a5bf-c92b-46fd-95a4-ddecf4ba899e

📥 Commits

Reviewing files that changed from the base of the PR and between 1fc9b2d and b3f1348.

📒 Files selected for processing (1)

• go.mod

---

Walkthrough

The go.mod file's go directive was updated from version 1.26.4 to 1.26.5. No other changes, dependency entries, or exported/public entity declarations were modified.

Changes

Go Version Update

Layer / File(s)	Summary
Go directive bump go.mod	The go directive version was incremented from 1.26.4 to 1.26.5.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the Go toolchain bump and the security fix addressed by the change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/go-1.26.5-govulncheck

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Tests: go test ./...
• [pass] Build: go run ./cmd/zero-release build
• [pass] Smoke build: go run ./cmd/zero-release smoke

Scope

Head: b3f1348987d3
Changed files (1): go.mod

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.

[gnanam1990]

Review (post-merge audit)

Verdict: Looks correct. Agree this was the right minimal fix.

One-line bump of the go directive from 1.26.4 → 1.26.5 addresses GO-2026-5856 (crypto/tls ECH privacy issue) that was failing CI govulncheck. Workflows resolve the toolchain via go-version-file: go.mod, so changing the directive is the complete lever — no app code or go.sum change needed. CI including Security & code health went green on the tip that merged.

Notes (non-blocking)

• No linked parent issue / issue-approved — acceptable for a direct CI/toolchain security point release, as noted in the PR checklist.
• No remaining 1.26.4 pins found in workflows; they all follow go.mod.

No correctness concerns. Shipping this unblocked other open PRs that were failing Security on 1.26.4.