main -> Update Go toolchain and x/net to address vulnerabilities and add CI gate

[saadqbal]

…ns; govulncheck CI gate (#278)

• fix(deps): toolchain go1.26.5 + x/net v0.57.0 — clear 6 reachable vulns

govulncheck reported 6 reachable vulnerabilities in the shipped CLI: 4 stdlib (GO-2026-5856 crypto/tls, fixed go1.26.5; GO-2026-5039 net/textproto, GO-2026-5038 mime, GO-2026-5037 crypto/x509, all fixed go1.26.4) plus 2 in golang.org/x/net v0.49.0 (GO-2026-4918 HTTP/2 infinite loop, fixed v0.53.0; GO-2026-5026 idna, fixed v0.55.0) — reachable via api.userAgentTransport.RoundTrip,
submit.HTTPSubmitter.Submit, and push.CheckCSVEncoding among others.

go.mod had no toolchain directive, so v0.8.0 release binaries carried whatever stdlib the runner's Go resolved to. Pin toolchain go1.26.5 (latest 1.26.x patch, verified against go.dev/dl) and bump x/net to v0.57.0 (latest stable; fix floor was v0.55.0). Only x/net and its sibling x/{sys,term,text} modules move — no k8s.io drift.

After: govulncheck ./... is clean; build, vet, -race suite, and lint all green under the pinned toolchain.

Part of tracebloc/backend#1106 (WS-A). See #276.

• ci: govulncheck gate on PRs + weekly cron sweep of develop

Two copies of one pinned job (govulncheck@v1.1.4, setup-go with go-version-file: go.mod so the module toolchain governs):

• build.yml: blocking job on every PR and push to develop/main — stops new code from introducing a reachable vuln.
• vulncheck.yml (new): weekly cron (Mon 05:30 UTC) + workflow_dispatch, checkout pinned to develop — a CVE published against code we already ship reddens develop within a week instead of waiting for the next PR. Cron activates once this file rides the normal develop -> main promotion (scheduled workflows fire from the default branch only).

Makefile grows a matching pinned vulncheck target, wired into make ci to keep the "make ci green => CI green" invariant.

Part of tracebloc/backend#1106 (WS-A). See #276.

---

Note

Medium Risk
Touches release toolchain and dependency versions that affect shipped binaries, but changes are security remediation with automated reachability gates rather than application logic refactors.

Overview
Addresses six reachable CVEs that previously shipped in the customer-installed CLI by pinning toolchain go1.26.5 in go.mod (stdlib fixes) and bumping golang.org/x/net and related x/{sys,term,text} modules; go.sum follows.

Adds blocking govulncheck on every PR/push via a new job in build.yml, a weekly vulncheck.yml workflow (Monday cron + workflow_dispatch, checkout on develop), and a pinned make vulncheck target included in make ci so local and CI stay aligned (GOVULNCHECK_VERSION / govulncheck@v1.1.4).

^{Reviewed by Cursor Bugbot for commit 078cca2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 55 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#181 — feat(weights): normalize-on-read — mixed cycles average instead of rejecting (SEC-03 §8 step 2) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#182 — feat(weights): averaging writes SafeTensors (TF + PyTorch) — SEC-03 §8 step 4 · author: @shujaatTracebloc · no reviewer assigned
• backend#1079 — feat(global_meta): edge dataset_meta exposure + attributes contract at ingest (#924 G4a) · author: @divyasinghds · no reviewer assigned
• backend#1086 — docs(rfc): SafeTensors weight-format migration — SEC-03 Phase 1 (RFC 0004) · author: @shujaatTracebloc · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1095 — feat(experiment): configurable preprocessing knobs incl. tabular scaler — RFC 0003 L1 + L1b (#1094) · author: @LukasWodka · no reviewer assigned
• backend#1100 — fix(boot): pin SDK install to tracebloc==0.11.2, drop 404 dev line (#1098) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1105 — perf(api): query micro-fixes — notifications N+1, cached data_scientist, composite index, sampling (#975) · author: @aptracebloc · no reviewer assigned
• backend#1108 — test(api): CLI response-shape contract fixtures for the 9 CLI endpoints (WS-D.2) · author: @LukasWodka · reviewer: @saadqbal
• cli#300 — chore(release): drop the Homebrew tap job + install.tracebloc.io promise · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)