chore: bump Go version to 1.26.4

[berendt]

Summary

Bumps the Go version used by the project to 1.26.4, and resolves the CI
breakage and security-scanner findings that surfaced as a result.

Go version bump

• go.mod: go 1.25.0 → go 1.26.4
• Dockerfile: FROM golang:1.25 → FROM golang:1.26.4

The CI workflows (ci.yml, release.yml) reference go-version-file: go.mod
and pick up the new version automatically — no changes needed there.

Toolchain compatibility (fixes E2E Tests job)

• Makefile: chainsaw v0.2.12 → v0.2.15

  chainsaw v0.2.12 fails to build under Go 1.26: Go 1.26 added the ModulePath
  method to the internal testing.testDeps interface, which chainsaw's
  TestDeps type does not implement (testing.MainStart argument mismatch).
  v0.2.15 restores compatibility.

Security fixes (fixes MegaLinter grype/osv-scanner/trivy findings)

Go modules bumped to fixed versions:

• go.opentelemetry.io/otel{,/sdk,/metric,/trace} 1.40.0 → 1.43.0
  (CVE-2026-29181, CVE-2026-39883)
• golang.org/x/net 0.48.0 → 0.55.0 (GO-2026-4918, GO-2026-5025..5030)
• golang.org/x/sys 0.40.0 → 0.45.0 (GO-2026-5024; required by x/net)

docs/ npm dev dependencies (transitive under vitepress, pinned via
overrides; vitepress 1.6.3 supports vite ^6):

• vite → 6.4.3, esbuild → 0.25.12, postcss → 8.5.16,
  rollup → 4.62.2
  (GHSA-4w7w-66w2-5vf9, GHSA-67mh-4wv8-2f99, GHSA-qx2v-qp2m-jg93, GHSA-mw96-cpmx-2vgc)

CI config (fixes MegaLinter zizmor audit)

• .mega-linter.yml: allow GITHUB_TOKEN through
  (ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES) so zizmor's online audits query the
  GitHub API instead of failing with HTTP 401 Unauthorized.

Test plan

• go mod verify passes; local toolchain go1.26.4 confirmed
• go build ./..., go vet ./... and make test (envtest) pass
• chainsaw v0.2.15 builds under Go 1.26.4 (make chainsaw)
• docs build succeeds with vite 6 (npm run docs:build)
• npm audit reports 0 vulnerabilities

🤖 Generated with Claude Code

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.34s
⚠️ ACTION	zizmor	5		1	0	0.37s
✅ COPYPASTE	jscpd	yes		no	no	2.46s
✅ DOCKERFILE	hadolint	1		0	0	0.06s
✅ JSON	jsonlint	5		0	0	0.09s
✅ JSON	prettier	5		0	0	0.43s
✅ JSON	v8r	5		0	0	8.69s
✅ MARKDOWN	markdownlint	49		0	0	1.93s
⚠️ MARKDOWN	markdown-table-formatter	49		1	0	0.34s
✅ REPOSITORY	betterleaks	yes		no	no	0.74s
✅ REPOSITORY	checkov	yes		no	no	31.13s
✅ REPOSITORY	gitleaks	yes		no	no	1.15s
✅ REPOSITORY	git_diff	yes		no	no	0.05s
✅ REPOSITORY	grype	yes		no	no	62.52s
✅ REPOSITORY	osv-scanner	yes		no	no	1.14s
✅ REPOSITORY	secretlint	yes		no	no	4.5s
✅ REPOSITORY	syft	yes		no	no	2.34s
✅ REPOSITORY	trivy	yes		no	no	22.72s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.06s
✅ REPOSITORY	trufflehog	yes		no	no	4.1s
✅ SPELL	cspell	410		0	0	9.27s
⚠️ SPELL	lychee	308		2	0	9.47s
⚠️ YAML	prettier	251		1	4	3.17s
✅ YAML	v8r	251		0	0	48.97s
✅ YAML	yamllint	251		0	0	4.18s

Detailed Issues

⚠️ SPELL / lychee - 2 errors

📝 Summary
---------------------
🔍 Total..........484
🔗 Unique.........335
✅ Successful.....480
⏳ Timeouts.........0
🔀 Redirected......12
👻 Excluded.........1
❓ Unknown..........0
🚫 Errors...........2
⛔ Unsupported......2

Errors in .github/workflows/release.yml
[404] https://github.com/$%7BREPO%7D/releases/download/$%7BGITHUB_REF_NAME%7D/install.yaml (at 169:24) | Rejected status code: 404 Not Found

Errors in docs/reference/crd-reference.md
[ERROR] https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources (at 28:24) | TLS handshake failed. Check SSL/TLS configuration

Hint: Followed 12 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

⚠️ MARKDOWN / markdown-table-formatter - 1 error

1 files contain markdown tables to format:
- docs/reference/crd-reference.md

⚠️ YAML / prettier - 1 error

Checking formatting...
[warn] config/crd/bases/memcached.c5c3.io_memcacheds.yaml
[warn] config/rbac/role.yaml
[warn] config/webhook/manifests.yaml
[warn] Code style issues found in 3 files. Run Prettier with --write to fix.

⚠️ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/ci.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository