build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05

The nixos-25.11 channel reached end of life on 2026-06-30 and its branch has not
moved since, so every tool pinned through it is frozen. Renovate fails to make
this change itself, possibly because of renovatebot/renovate#45000.

This commit points the nixpkgs input at nixos-26.05 and refreshes only that
input, leaving nixpkgs-unstable and gomod2nix alone.

Moving the channel moves the whole toolchain, which accounts for the rest of the
diff. protoc-gen-go 1.36.10 to 1.36.11 and protoc-gen-go-grpc 1.5.1 to 1.6.2
regenerate the protobuf output. golangci-lint 2.6.2 to 2.12.2 reports new
findings from goconst. It now ignores tests, which stops occurrences there
inflating its counts, and pkg/xcrd is excluded because its OpenAPI schema
literals read better inline than behind constants. The remaining finding is
addressed in place.

The new toolchain also prints two deprecation warnings, both cleared here.
nixpkgs 26.05 aliases nixfmt-rfc-style to nixfmt, so now we just use nixfmt
directly. golangci-lint deprecates gomodguard in favour of gomodguard_v2, which
default: all already enables, so the deprecated linter joins the disable list.

Signed-off-by: Jared Watts <jbw976@gmail.com>

Author: jbw976

.golangci.yml

@@ -95,6 +95,9 @@ linters:
     # against idiomatic Go programming, which encourages this approach - e.g.
     # to scope errors.
     - noinlineerr
+
+    # Deprecated in favour of gomodguard_v2, which is enabled by default: all
+    - gomodguard
   settings:
     depguard:
       rules:
@@ -117,6 +120,7 @@ linters:
     goconst:
       min-len: 3
       min-occurrences: 5
+      ignore-tests: true
     gocritic:
       enabled-tags:
         - performance
@@ -159,7 +163,6 @@ linters:
           - gochecknoglobals
           - gochecknoinits
           - gocognit
-          - goconst
           - gosec
           - scopelint
           - unparam
@@ -178,6 +181,14 @@ linters:
           - gochecknoinits
         path: apis/
 
+      # The xcrd package builds OpenAPI schemas, so it repeats schema
+      # vocabulary like "string", "object", and "apiVersion". Each literal
+      # mirrors the schema field it emits, which reads better than a named
+      # constant standing in for it.
+      - linters:
+          - goconst
+        path: pkg/xcrd/
+
       # These are performance optimisations rather than style issues per se.
       # They warn when function arguments or range values copy a lot of memory
       # rather than using a pointer.

apis/changelogs/proto/v1alpha1/changelog.pb.go

@@ -5,7 +5,7 @@
   description = "Crossplane Runtime - Go library for building Crossplane providers and controllers";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
 
     # TODO(negz): Unpin once https://github.com/nix-community/gomod2nix/pull/231 is released.
@@ -99,7 +99,7 @@
               pkgs.kubernetes-controller-tools
 
               # Nix
-              pkgs.nixfmt-rfc-style
+              pkgs.nixfmt
             ];
 
             shellHook = ''

apis/changelogs/proto/v1alpha1/changelog_grpc.pb.go

@@ -120,7 +120,7 @@
         nativeBuildInputs = [
           pkgs.statix
           pkgs.deadnix
-          pkgs.nixfmt-rfc-style
+          pkgs.nixfmt
         ];
       }
       ''