ci(test): matrix go image to 1.25 and 1.26.3 (#754)

Run tests under both supported Go versions. Coverage artifact is named
per version; sonar consumes coverage-1.26. The go/1.26 PR label marks
code that requires Go 1.26+, making the 1.25 job non-blocking.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: wikkyk

.github/workflows/test.yml

@@ -87,8 +87,18 @@ jobs:
     if: always() && (needs.pre-screen.result == 'success' || needs.pre-screen.result == 'skipped')
     runs-on: ubuntu-latest
     permissions: {}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - go: "1.25"
+            image: golang@sha256:298734aec230b5f3e8cee450ce6d7eccc39f1797ba548ee90d57e9803030c6c3 # 1.25-bookworm
+          - go: "1.26"
+            image: golang@sha256:a085df697019cb63b40a70f6a92b948f7dc9df96dfcb2c20ba6eed25ce28f5b3 # 1.26.3-trixie
+    # Allow the 1.25 job to fail on PRs labelled go/1.26 (code requires 1.26+).
+    continue-on-error: ${{ matrix.go == '1.25' && contains(github.event.pull_request.labels.*.name, 'go/1.26') }}
     container:
-      image: golang@sha256:298734aec230b5f3e8cee450ce6d7eccc39f1797ba548ee90d57e9803030c6c3 # 1.25-bookworm
+      image: ${{ matrix.image }}
     env:
       GOTOOLCHAIN: local
     steps:
@@ -106,7 +116,7 @@ jobs:
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: coverage
+          name: coverage-${{ matrix.go }}
           path: cover.out
           retention-days: 7
 
@@ -142,7 +152,7 @@ jobs:
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: coverage
+          name: coverage-1.26
           path: ${{ runner.temp }}/coverage
 
       # fail-fast against malformed coverage file