chore: bump dependencies, tooling, CI actions and base image

[Vatoth]

Bumps everything that was behind.

Go dependencies

• golang.org/x/tools v0.49.0 → v0.50.0
• golang.org/x/mod v0.40.0 → v0.41.0 (indirect)
• golang.org/x/sync v0.22.0 → v0.23.0 (indirect)
• github.com/golangci/plugin-module-register unchanged — v0.1.2 is already latest

Tooling

• golangci-lint v2.13.1 → v2.13.2, in both src/Dockerfile and src/.custom-gcl.yml (these two must stay in lockstep)

Base image

• golang:1.27-bookworm → golang:1.27-trixie (Debian 13) for both build and final stages

CI actions

All four were a major behind:

• docker/metadata-action v5 → v6
• docker/setup-buildx-action v3 → v4
• docker/login-action v3 → v4
• docker/build-push-action v5 → v7

Each of those majors is a Node 24 runtime + ESM rewrite. I read the release notes; none of the removed inputs/outputs are used by this workflow, so they're drop-in.

Verification

Run locally, not just eyeballed:

• go build ./..., go vet ./..., go test ./... — all pass (4 test packages)
• Installed golangci-lint v2.13.2, ran golangci-lint custom -v to rebuild the plugin binary against it, then ./custom-gcl run → 0 issues
• Built the full image on trixie: lint + tests pass inside the build, and every shipped binary runs in the final image (custom golangci-lint v2.13.2 w/ vinego plugin, staticcheck 2026.2.1, dlv 1.27.2, gci 0.14.0, goimports)

Note: Go itself is already current — go1.27.1 is the newest release and the 1.27 image tag tracks it.

🤖 Generated with Claude Code