chore(DCP-3225): bump go toolchain to 1.26.5 to patch symlink vulnerability

[script-this]

Summary

Snyk flagged CVE-2026-39822 (CVSS 8.5, High) in the Go standard library's os package: on Unix, opening a path inside an os.Root that ends in / whose final component is a symlink can escape the intended root. This is a toolchain-level vulnerability, not a third-party dependency, so the fix is bumping the go directive in go.mod from 1.26.3 to 1.26.5 (the patched release).

Why this approach

The Dockerfile's build image was already bumped to golang:1.27rc2-alpine by Dependabot in a prior merge (already past the fixed version for this CVE), and CI's go-version: [1.26.x] in go.yml floats to the latest matching patch automatically. The one place still pinning the vulnerable version was go.mod's go directive itself, which Dependabot doesn't touch. go mod tidy confirms go.sum is unaffected — this is a pure toolchain version bump, no dependency changes.

Rollback

Revert this commit to restore go 1.26.3 in go.mod. No other files change.

[prolific-snyk]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.