ci: build and test with Go 1.26.10 to clear stdlib vulnerabilities

govulncheck fails on Go 1.26.6 with 10 reachable standard library
vulnerabilities (net/http, net/textproto, crypto/tls fixed in 1.26.9;
crypto/x509 GO-2026-6809 fixed in 1.26.10). The fix is the toolchain, not
a module, so Dependabot (gomod only) never proposes it. Bumping the pin in
release.yml also means released binaries ship the patched standard library.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRc1axJoxMwiK5nm2q7YqP

Author: claude

.github/workflows/acceptance.yml

@@ -101,7 +101,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.10"
 
       - name: Run Go Acceptance Tests (slice ${{ matrix.slice }})
         # 30m, not 12m: slice 0 timed out at exactly 720s once the MCP tests
@@ -133,7 +133,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.10"
 
       - name: Run telemetry acceptance tests
         run: go test -tags=telemetry ./test/acceptance/... -v -timeout 12m

.github/workflows/outpost-live.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.10"
 
       # The tests skip themselves when the key is absent, which is right for a
       # developer machine and wrong here: a missing secret would turn this job

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -56,7 +56,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -76,7 +76,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -151,7 +151,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
 
       - name: Build npm binaries with GoReleaser
         uses: goreleaser/goreleaser-action@v5

.github/workflows/test-npm-build.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
 
       - name: Set up Node.js
         uses: actions/setup-node@v4

.github/workflows/test.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run unit tests
         run: go test -short ./pkg/...
       # `go test` runs a reduced vet suite (printf, bools, atomic and a few
@@ -50,7 +50,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run govulncheck
         # Pinned rather than @latest: a new govulncheck release could change
         # behaviour or fail this job with no change to the repo. Bump
@@ -70,7 +70,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -102,7 +102,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -121,7 +121,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with: