chore: bump Go toolchain to 1.26.5 for stdlib CVEs

[atkrad]

What problem would this solve?

The OSV-Scanner scheduled scan on main fails (fail-on-vuln: true) because go.mod still declares go 1.26.3. OSV reports five reachable stdlib advisories that are fixed in 1.26.4 / 1.26.5:

• GO-2026-4970 (fixed 1.26.5)
• GO-2026-5037 (fixed 1.26.4)
• GO-2026-5038 (fixed 1.26.4)
• GO-2026-5039 (fixed 1.26.4)
• GO-2026-5856 (fixed 1.26.5)

Example failure: https://github.com/deployah-dev/deployah/actions/runs/30853107617

Nixpkgs/flake.lock and the pinned golang:1.26-alpine image digest already resolve to Go 1.26.5; only the module go line is stale.

What do you want?

1. Bump go.mod to go 1.26.5.
2. Confirm local osv-scanner source scan passes (aside from ignored GO-2026-5932).
3. Keep Dockerfile digest as-is if it already points at 1.26.5 (optionally clarify the tag to 1.26.5-alpine).

Alternatives considered

• Ignoring the GO IDs in osv-scanner.toml or setting fail-on-vuln: false (hides real stdlib issues).