fix(deps): bump Go toolchain pin to 1.26.9

[Danathar]

What

Moves knuckle's Go version from 1.26.6 to 1.26.9. This is the go line in go.mod and the go-version given to actions/setup-go in four workflows. No Go code changes.

File	Pins changed
.github/workflows/ci.yml	7
.github/workflows/nightly.yml	4
.github/workflows/release.yml	2
.github/workflows/security.yml	1
go.mod	1

Why

govulncheck is a required check, and it has failed on every CI run since 2026-10-10, including the merge queue. Go 1.26.6 has nine standard-library vulnerabilities that knuckle's code reaches, and all of them are fixed in Go 1.26.9:

ID	Package
GO-2026-6617, -6613, -6612, -6611, -6610, -6605, -6603	net/http
GO-2026-6608	net/textproto
GO-2026-6607	crypto/tls

Source: the govulncheck job in merge-queue run 38127820735. Every finding reads "Found in: …@go1.26.6, Fixed in: …@go1.26.9".

So nothing can merge right now. #928 has been dropped from the merge queue on every attempt since 2026-10-10 09:16 UTC, and the other open dependency PRs (#923, #927, #929, #931) will hit the same failure.

This is the same change as #868, which moved the pin from 1.26.5 to 1.26.6 for the same reason.

How tested

• just ci is green locally (details below: everything passed except two steps that fail on this machine for reasons unrelated to this change)
• just vm-e2e passes (end-to-end install + boot)
• just headless-test passes (for headless-mode changes)
• Tested on real hardware — describe below
• Doc / template / CI change only — no install path touched

Run locally with Go 1.26.9 (GOTOOLCHAIN=go1.26.9):

• go mod tidy: no changes, so go.mod and go.sum stay clean.
• gofmt -l, go vet ./... and golangci-lint run ./...: clean.
• go test -race ./...: all 18 packages pass.
• govulncheck ./... (v1.7.0, as in CI): "Your code is affected by 0 vulnerabilities", exit 0.
• just shell-lint and just build: pass.

Two just ci steps fail on this machine, and they fail the same way on unchanged main:

• just cover-check: internal/headless comes out at 98% against a 99% target. Unchanged main with Go 1.26.6 gives the same 98% here. CI's coverage gate job passes on main.
• just headless-test: the Flatcar dry-run passes. The FCOS dry-run stops because the recipe writes to /tmp, which is out of space on this machine. CI's headless e2e (dry-run) job passes on main.

Scope check

No change to what knuckle supports. Only the Go version used to build and test it moves.

Notes for reviewers

• vm-e2e.yml asks for go-version: "1.26" with no patch number, so it already gets the latest 1.26 release. It's unchanged here, as it was in fix(deps): bump Go toolchain pin to 1.26.6 #868.
• AGENTS.md says a toolchain bump should also add toolchain goX.Y.Z to go.mod. I left that out on purpose: go mod tidy deletes a toolchain line that matches the go line, so it would fail the "go.mod clean after tidy" step in just ci. main has no toolchain line today either. The same note says ci.yml has two Go pins; it has seven. I'm happy to fix that note in a follow-up.
• To build knuckle locally you now need Go 1.26.9 or newer. With Go's default GOTOOLCHAIN=auto, go downloads it automatically.

[castrojo]

Approving Go toolchain pin bump to 1.26.9. All CI checks are green (build+test, govulncheck, coverage gate, headless e2e, cross-compile arm64). Resolves stdlib CVEs flagged by govulncheck.