chore: bump Go toolchain to 1.26.5 for stdlib CVEs

The OSV-Scanner scheduled scan failed because go.mod still said go 1.26.3. Five reachable stdlib advisories were already fixed in 1.26.4 / 1.26.5 (GO-2026-4970, 5037, 5038, 5039, 5856).

Nixpkgs and the Dockerfile digest were already on 1.26.5. Shipped in #63: bump go.mod to go 1.26.5. Did not ignore the GO IDs or turn off fail-on-vuln.

Later superseded by the Go 1.27 bump (#67).