fix(deps): patch reachable vulns (x/text, go 1.26.5), suppress unreachable transitive CVEs

[bborbe]

Unblocks the parked Update-Go task. make check green.

• x/text → v0.39.0 (CVE-2026-56852), Go 1.26.4 → 1.26.5 (GO-2026-5856 stdlib)
• Suppressed unreachable+unfixable transitives (govulncheck-confirmed): containerd GO-2026-5064/5338/5622, x/crypto/openpgp GO-2026-5932 — consistent with existing docker/docker suppressions

[ben-s-pull-request-reviewer]

All changes reviewed. Let me consolidate the report.

Review Summary:

• .trivyignore — Added GO-2026-5932 suppression for x/crypto/openpgp with valid justification (unmaintained, transitive only, not imported). ✅
• CHANGELOG.md — Properly structured ## Unreleased entry. ✅
• Dockerfile — Go 1.26.4 → 1.26.5, consistent with go.mod. ✅
• go.mod / go.sum — Go version bump + x/text v0.39.0 (fixes CVE-2026-56852) +连带 transitive bumps (x/crypto, x/net, x/mod, x/sync, x/sys, x/telemetry, x/term, x/tools). All versions consistent. ✅

No Go source files changed. No code-level findings.

{
  "verdict": "approve",
  "summary": "Dependency update PR — Go 1.26.5, x/text v0.39.0 (CVE-2026-56852 fix), suppressed unreachable x/crypto/openpgp CVE. Versions consistent across Dockerfile/go.mod/go.sum. CHANGELOG properly documents the change.",
  "comments": [],
  "concerns_addressed": [
    "security: x/text bumped to v0.39.0 resolving CVE-2026-56852 — verified in go.mod",
    "correctness: Dockerfile Go 1.26.5 matches go.mod — verified consistent",
    "security: GO-2026-5932 (x/crypto/openpgp) suppressed as transitive/unreachable — verified via go.mod // indirect marker"
  ]
}