security: raise release builder to Go 1.26.7

[rldyourmnd]

Outcome

Raises the exact GDS release builder and minimum security floor from Go 1.26.5 to Go 1.26.7 and makes vulnerability scanning an executable full/release gate.

Why

govulncheck v1.6.0 found five reachable standard-library vulnerabilities with Go 1.26.5: GO-2026-6218, GO-2026-6090, GO-2026-6089, GO-2026-5972, and GO-2026-5026. Go 1.26.7 contains the security fixes from 1.26.6 plus the subsequent net/http patch release.

Changes

• pin CI, release builder, module, validation, and device bootstrap to Go 1.26.7;
• execute pinned govulncheck v1.6.0 in full, PR-required, and release validation;
• verify official Go archive SHA-256 before device bootstrap extraction;
• update generated workflow, bundle lock, ruleset mirror, source register, contracts, runbooks, and goldens;
• record the security-floor refresh in the security evidence.

Verification

• GOTOOLCHAIN=go1.26.7 scripts/validate_ci_tier.sh pr-required
• GOTOOLCHAIN=go1.26.7 go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... → No vulnerabilities found.
• projection materialization completed through signed plan/apply/verify.