Raise Go toolchain to 1.26.4 and refresh deps

[KristjanPikhof]

Description

Security and toolchain maintenance bump for ACD. This PR raises the minimum Go
toolchain to 1.26.4, refreshes pinned dependencies (notably
modernc.org/sqlite and fsnotify), adds automated vulnerability scanning in
CI, and configures Dependabot for ongoing Go module and GitHub Actions updates.

There are no application logic changes — no edits to internal/daemon,
internal/state, CLI behavior, hooks, or schema. The diff is limited to
go.mod/go.sum, CI workflows, Dependabot config, and release-contract docs.

Type of Change

• New feature
• Bug fix
• Refactoring (no functional changes)
• Documentation update
• Infrastructure / CI/CD
• Performance improvement

Changes Made

Go toolchain

• Raise module minimum from Go 1.22 to Go 1.26.4 (go.mod, all workflows).
• Centralize workflow Go version in a shared GO_VERSION: '1.26.4' env var
  (ci.yml, codeql.yml, release.yml); remove the CI matrix that pinned
  go: ['1.22'].

Direct dependency bumps

Package	Before	After	Role in ACD
modernc.org/sqlite	v1.36.0	v1.52.0	Repo state DB (state.db)
github.com/fsnotify/fsnotify	v1.7.0	v1.10.1	Worktree file watching
github.com/spf13/cobra	v1.8.0	v1.10.2	CLI commands
golang.org/x/sys	v0.30.0	v0.46.0	Low-level syscalls
github.com/mattn/go-isatty	v0.0.20	v0.0.22	Terminal detection

Indirect deps (modernc.org/libc, modernc.org/memory, etc.) updated with
the SQLite stack.

CI hardening

• New govulncheck job in ci.yml using the module-pinned tool:
  go tool govulncheck ./...
• Pin golang.org/x/vuln/cmd/govulncheck as a module tool in go.mod.
• CodeQL: run setup-go before codeql-action/init so analysis uses the
  correct toolchain.
• Release: enable Go module cache in release.yml.

Dependabot (new)

• .github/dependabot.yml — weekly updates for Go modules and GitHub Actions.
• Group minor/patch vs major separately; cap open PRs at 5 per ecosystem.
• Compatible with SHA-pinned workflow actions (# vN.M.P comment convention).

Documentation

• CHANGELOG.md — unreleased note for Go 1.26.4 and sqlite bump.
• README.md — "Building from source requires Go 1.26.4 or newer."
• CLAUDE.md — agent guide version pins updated.

Scope decision

This branch is a single review/rollback unit: all 13 commits are
maintenance/CI/deps work with no user-facing feature changes. Splitting would
not improve reviewability.

Impact

End users (prebuilt binaries)

No intended behavior change. Install via brew, install.sh, or GitHub releases
is unchanged.

Developers building from source

Breaking for builders only: requires Go 1.26.4+ for go install and
make build.

Runtime subsystems (indirect, not intentional change)

Subsystem	Risk	Notes
SQLite (state.db)	Low–medium	Large driver jump; schema unchanged. Migration/WAL tests pass.
fsnotify	Low	Backward compatible for typical watcher use.
Cobra/pflag	Very low	CLI flag parsing only.

How to Test

Pre-PR gate (from AGENTS.md):

cleanenv() { env -u ACD_INTENT_MIN_PENDING -u ACD_INTENT_MAX_PENDING_AGE \
  -u ACD_INTENT_WINDOW -u ACD_INTENT_RECENT_COMMITS -u ACD_INTENT_DEFER_LIMIT \
  ACD_COMMIT_STRATEGY=event "$@"; }

cleanenv make lint
cleanenv make test
cleanenv go test ./test/integration/... -tags=integration -race -count=1 -timeout 5m
cleanenv go test ./internal/daemon/... ./internal/git/... ./internal/state/... \
  ./internal/pause/... ./internal/cli/... -race -count=3 -timeout 10m

SQLite-focused verification:

cleanenv go test ./internal/state/... -race -count=1 \
  -run 'Migrat|Schema|WAL|Concurrent|OpenExisting' -v
go tool govulncheck ./...

Local verification performed

• make lint — pass
• go test ./internal/state/... -race — pass (incl. v4→v10 migrations, WAL concurrency)
• go test ./test/integration/... -tags=integration -race — pass (~192s)
• go test ./internal/daemon/... ./internal/cli/... -race — pass
• go tool govulncheck ./... — no vulnerabilities found
• Live repo state.db: PRAGMA integrity_check → ok, user_version=10, WAL mode
• Running daemon on branch binary reads/writes state successfully (status, events, explain)

Checklist

• Code follows the project's style guidelines
• Self-reviewed the code for obvious errors
• Added or updated tests where applicable (no new tests needed; existing suite covers sqlite/migrations)
• Existing tests pass locally
• Updated documentation if needed
• No new warnings or console errors introduced

Related Issues

None.

Screenshots

N/A — infrastructure and dependency maintenance only.