ci: patch-pin Go toolchain in release workflow for reproducible provenance

[millerjp]

Summary

release.yml uses go-version: "1.26" which resolves to latest 1.26.x at dispatch. A silent minor bump between releases changes binary provenance for identical source — undermines attestation reproducibility arguments.

Scope

Pin release workflow to a specific 1.26.X (the version recorded in bench.txt). CI workflow keeps floating 1.26.

Acceptance criteria

1. release.yml pins 1.26.X explicitly.
2. Dependabot gomod ecosystem picks up the patch.

Source: security-reviewer.