WS-A.1: toolchain pin + x/net bump — clear 6 reachable vulns; govulncheck CI gate; cut v0.8.1

[LukasWodka]

Part of epic tracebloc/backend#1106 (WS-A: Security & toolchain). Report: https://claude.ai/code/artifact/b4b6e6a6-4d76-4e46-a668-6f4f0f944344 — §5 WS-A.1.

Context

govulncheck ./... reports 6 reachable vulnerabilities in the shipped CLI: 4 stdlib (incl. GO-2026-5856 in crypto/tls, fixed in go1.26.4/.5) — go.mod declares go 1.26.0 with no toolchain directive, so released v0.8.0 binaries were built with the vulnerable stdlib — plus 2 in golang.org/x/net v0.49.0 (GO-2026-4918 HTTP/2 infinite loop, fixed v0.53.0; GO-2026-5026, fixed v0.55.0 → combined bump floor v0.55.0), reachable via api.userAgentTransport.RoundTrip, submit.HTTPSubmitter.Submit, push.CheckCSVEncoding. This is a customer-installed binary.

Tasks

• Add toolchain go1.26.5 to go.mod (verify latest 1.26.x patch at implementation time)
• go get golang.org/x/net@v0.55.0 (or current fix floor) + go mod tidy
• Verify locally: govulncheck ./... → 0 reachable vulns; full unit suite green
• Confirm release.yml's Go setup honors the toolchain directive (setup-go with go-version-file)
• New CI job: pinned govulncheck@v1.1.4 on PRs/develop + weekly cron (a new CVE should redden develop, not wait for the next PR)
• Flag to Asad: cut v0.8.1 after merge via the normal develop→main promotion — rebuild + dep bump, no behavior change

Exit criteria

• govulncheck green locally and as a required CI job with weekly schedule
• v0.8.1 tagged from a promoted main containing this change; customers get clean binaries

[LukasWodka]

Shipped: PR #278 merged to develop and released in v0.9.1 (govulncheck now clean; toolchain + x/net bump in customer binaries). Closing as completed — the 'Fixes #276' auto-close didn't fire because PRs target develop, not the default branch.