chore(deps): bump go directive 1.26.4 → 1.26.5 (GO-2026-5856)

[smecsia]

What

Bumps the go directive in go.mod from 1.26.4 to 1.26.5.

Why

govulncheck reads the stdlib version it scans from the go directive. Go 1.26.4 is affected by GO-2026-5856 (crypto/tls), fixed in go1.26.5. The finding is reachable through several pre-existing paths, so the reachability gate now fails on every Go-touching PR until the toolchain is bumped:

Vulnerability #1: GO-2026-5856  (crypto/tls@go1.26.4 → fixed in go1.26.5)
  #1 pkg/util/exec.go … tls.Conn.Handshake
  #2 pkg/assistant/mcp/server.go … tls.Conn.HandshakeContext
  #3 pkg/assistant/llm/ollama.go … tls.Conn.Read
  #4 pkg/api/git/repo.go … tls.Conn.Write
  #5 pkg/clouds/pulumi/mongodb/drop_db.go … tls.Dial
  #6 pkg/assistant/llm/openai.go … tls.Dialer.DialContext

Bumping the directive clears the advisory fleet-wide (unblocks #363 and any other open Go PR). go1.26.5 is released; GOTOOLCHAIN=auto already resolves the toolchain, and the other workflows read the version from go.mod / auto-upgrade — so no source change is needed.

Scope

One line in go.mod. No code changes.

🤖 Generated with Claude Code

[github-actions]

Semgrep Scan Results

Repository: api | Commit: ab3f334

Check	Status	Details
⚠️ Semgrep	Warning	1 warning(s), 5 total

Scanned at 2026-07-14 18:48 UTC

[github-actions]

Security Scan Results

Repository: api | Commit: ab3f334

Check	Status	Details
✅ Secret Scan	Pass	No secrets detected
⚠️ Dependencies (Trivy)	High	2 high, 3 total
⚠️ Dependencies (Grype)	High	2 high, 3 total
📦 SBOM	Generated	523 components (CycloneDX)

Scanned at 2026-07-14 18:49 UTC

[github-actions]

📊 Statement coverage

Measured on the documented included set (see docs/TESTING.md → Coverage scope). Observe-only — no regression gate is enforced yet.

Scope	This PR	main baseline	Δ
Included set (Gold-tier denominator)	90.3%	90.3%	+0.0 pp
Full set (whole repo, transparency)	28.0%	28.0%	+0.0 pp

Baseline: main @ d64c472