Upgrade to Go 1.26, golangci-lint v2.10, and update dependencies

[pjcdawkins]

Summary

• Upgrade Go from 1.25 to 1.26
• Upgrade golangci-lint from v2.4.0 to v2.10.1
• Upgrade GitHub Actions: checkout v5->v6, setup-go v5->v6, golangci-lint-action v8->v9
• Update all dependencies via go get -u ./...
• Apply go fix ./... modernizers: SplitSeq iterators, slices.Contains, remove unnecessary loop variable copies, interface{} -> any
• Fix new lint issues from golangci-lint v2.10 (QF1012, gosec taint analysis false positives)

Test plan

• make test passes
• make lint passes (0 issues)
• make build succeeds
• CI passes on GitHub Actions

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR upgrades the repository’s Go toolchain and CI/linting stack, then applies automated modernizations and dependency updates to keep the codebase aligned with Go 1.26-era idioms and the newer golangci-lint ruleset.

Changes:

• Bump Go version to 1.26, refresh dependencies (go.mod/go.sum), and update cached expressions (expr.cache).
• Upgrade CI and lint tooling (GitHub Actions versions, golangci-lint version) and adjust Makefile guidance.
• Apply go fix/modernization changes (e.g., any, slices.Contains, strings.SplitSeq, removal of unnecessary loop-var capture) and add targeted //nolint:gosec suppressions for CLI/test cases.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/searchfs/fs_test.go	Minor string builder formatting modernization in test helper.
pkg/rules/yaml.go	Update YAML unmarshaler signature to use any.
pkg/rules/analyze.go	Remove unnecessary loop variable capture under newer Go range semantics.
pkg/digest/redact_secrets_test.go	Add gosec suppressions for intentionally fake secrets in tests.
pkg/digest/files.go	Use slices.Contains for null-byte detection in text/binary heuristic.
pkg/dep/js.go	Switch to strings.SplitSeq iterator-based splitting.
cmd/whatsun/terminal.go	Add gosec suppression for Fd() int conversion rationale.
cmd/warm_cache/main.go	Add gosec suppression for CLI stderr output.
cmd/validate/main.go	Add gosec suppression for CLI stderr output.
cmd/gen_docs/main.go	Add filepath.Clean on output path, switch to fmt.Fprintf patterns, and add gosec suppressions for CLI output/path.
Makefile	Bump golangci-lint version and update Go 1.26 jsonv2 note/link.
AGENTS.md	Update documented required Go idioms baseline to Go 1.26+.
.github/workflows/tests.yml	Update actions versions and Go version used in CI tests.
.github/workflows/golangci-lint.yml	Update actions versions and golangci-lint-action + linter version.
go.mod	Set go 1.26 and update direct/indirect module requirements.
go.sum	Refresh module checksums after dependency updates.
expr.cache	Refresh generated cache content corresponding to updated deps/toolchain.

[ganeshdipdumbare]

@pjcdawkins The test regarding this one is still there:

	// Detected without having a package manager.
	"configured-app/.platform.app.yaml": &fstest.MapFile{Data: []byte("name: app")},

Do we need this anymore?
Here: https://github.com/upsun/whatsun/blob/main/pkg/rules/analyze_testfs_test.go#L64

[pjcdawkins]

Do we need this anymore? Here: https://github.com/upsun/whatsun/blob/main/pkg/rules/analyze_testfs_test.go#L64

we will be reworking that in #23 so I'll leave that for now