Patch Go and nanoid security baselines

[leonfox28]

Summary

• upgrade the pinned Go toolchain and container builder from 1.26.5 to 1.26.6
• update the official Go archive checksums and pinned multi-platform image digest
• force vulnerable nanoid versions below 3.3.18 to the patched release and refresh the lockfile

Validation

• make security
• corepack pnpm audit --prod --audit-level moderate
• CI=true corepack pnpm install --frozen-lockfile
• make verify-modules
• make lint
• umask 0022; make test
• make build-go
• make check-container-files
• go test ./internal/containercontract
• corepack pnpm --dir web typecheck
• corepack pnpm --dir web test
• corepack pnpm --dir web build
• make verify-generated
• corepack pnpm --dir web e2e