fix(ci): 升级 Go 安全基线，修复定时漏洞审计失败 #289

Problem

The scheduled full CI run 37861275298 fails in Go dependency audit. Go 1.25.14 / govulncheck v1.6.0 reports 10 reachable standard-library advisories after the vulnerability database update on 2026-10-08. The scan lists Go 1.26.9 as the fixed version and x/net v0.60.0 for the related HTTP/2 module advisories.

The previous scheduled run 37703221680 passed on the same main commit (736f47dcae16e0240fb07ec85042e16b68243214), Go version and scanner, using the earlier database. PR #288 selected only affected checks and skipped this audit. The daily full run was introduced by #256 to complement partial PR/push checks.

Scope and boundary

• Upgrade the minimum Go toolchain and both CI and release builders to a supported security-patched version; update the affected x/net dependency and required transitive changes only.
• Keep the vulnerability audit blocking and preserve the existing nightly / affected-check selection policy.
• Align Windows fixed-toolchain validation and active platform packaging metadata with the supported compiler; retain exact official archive verification.
• Preserve runtime policy, credentials, workspace confinement and network authorization. No application feature or authority expansion.
• Keep historical validation records intact and describe any necessary platform compatibility correction explicitly.

Acceptance

• The updated source passes govulncheck against the current database.
• Module graph verification/tidiness and focused build/helper regression tests pass.
• Full CI, including native platform, Store, race and actual browser checks, succeeds for the repair head.
• Release validation uses the same repaired toolchain and passes its applicable packaging checks.
• Current developer/build documentation reflects the supported toolchain and explains time-varying vulnerability results.

Verification result

Implemented in #290 at 560c6b66e63e8b37965aae3d7045dd5e9b4f65ec; awaiting merge.

• Full CI: all 22 jobs passed, none skipped. The Windows job required one failed-job retry on the unchanged head; the initial command-output interruption remains an unconfirmed reliability issue and is documented in the PR.
• Native release validation: Windows and macOS amd64/arm64 packaging passed. PR-only release publication/attestation jobs were intentionally skipped.
• Go 1.26.9 / govulncheck v1.6.0 reports 0 reachable vulnerabilities with the same 2026-10-08 22:31:09 UTC database used by the failing nightly run. The existing schedule remains unchanged.