fix(deps): bump Go toolchain to 1.26.4 to patch stdlib CVEs (#983)

* fix(deps): bump Go toolchain to 1.26.4 to patch stdlib CVEs

The v1.0.6 release binary is compiled with Go 1.26.0 stdlib, which a
security scanner flags for 29 stdlib vulnerabilities (issue #979).
Because GOTOOLCHAIN=auto honors the go.mod directive, bumping it to
1.26.4 forces the release build to compile against the patched stdlib.

Fixes #979

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: install Go 1.26.4 directly in release and unit-test workflows

Match the go.mod directive so CI builds/tests on the patched toolchain
instead of relying on GOTOOLCHAIN auto-download.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: alexluong

.github/workflows/release.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.0
+          go-version: 1.26.4
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v4
         with:

.github/workflows/unit-tests.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23.0'
+          go-version: '1.26.4'
 
       - name: Install gotestsum
         run: go install gotest.tools/gotestsum@latest

go.mod

@@ -1,6 +1,6 @@
 module github.com/hookdeck/outpost
 
-go 1.26.0
+go 1.26.4
 
 require (
 	cloud.google.com/go/pubsub v1.50.2