[stackstate-agent] Bump the Go toolchain to clear stdlib CVEs blocking the image scan gate

[LouisParkin]

stackstate-7.78.2 has failed DEB package build and Binary builds since 2026-08-13. The image-pipeline scan gate reports 17–18 unmanaged findings on both the agent and cluster-agent images, dominated by Go stdlib CVEs against the pinned toolchain.

CVE-2026-33818  HIGH   stdlib  encoding/asn1 DoS
CVE-2026-39821  HIGH   stdlib
CVE-2026-46600  HIGH   stdlib
CVE-2026-56853  HIGH   stdlib
CVE-2026-56859  HIGH   stdlib
CVE-2026-56862  HIGH   stdlib
CVE-2026-56858  MED/HIGH  stdlib   (grype MEDIUM, trivy HIGH)
CVE-2026-56860  MED/HIGH  stdlib   (grype MEDIUM, trivy HIGH)
CVE-2026-56864  UNKNOWN   golang.org/x/mod v0.37.0
CVE-2026-56865  UNKNOWN   golang.org/x/mod v0.37.0

Current pins: .go-version 1.25.12, go.mod declares go 1.25.11, golang.org/x/mod v0.37.0.

Scanner-reported fixes: Go 1.25.13 clears everything except CVE-2026-46600, which is fixed only in 1.26.6 / 1.27.0-rc.3. So a 1.25.13 bump leaves one HIGH needing either a VEX/exception with a next-action date, or a move to the 1.26 line. x/mod needs its own bump.

Why this is urgent beyond the CVEs

Required checks on stackstate-7.78.2 are CI success (lint and unit tests), CI success (DEB package build) and CI success (binary builds). The latter two fail, so no PR can merge into the release branch — including the GitLab→GitHub migration cutover work (#460, #458). This is currently the critical path for archiving the GitLab agent project (STAC-25142 / STAC-25464).

Note the DEB publish lane itself is not gated on build-agent-image (sign-and-publish-deb needs only await-verification, build-deb, test-deb-renaming), so publishing would still run on a push. The block is on merging, not publishing.

Suggested scope

• Bump .go-version and the go.mod toolchain directive
• Bump golang.org/x/mod
• Decide 1.25.13 + exception for CVE-2026-46600, or go to 1.26.x
• Confirm the gate goes green on both agent and cluster-agent images, amd64 and arm64