build(deps): gomod group, on one Go version across all 17 modules

[josephschorr]

Supersedes #45 — same dependency bumps, made buildable.

Why #45 could not merge

It raised the Go directive in 4 of 17 modules, to three different values (1.25.0,
1.25.8, 1.26.5), so path-linked modules stopped agreeing:

module ../proto-clients/spicedb-go-proto requires go >= 1.25.8 (running go 1.25.0)

main was already ragged here — 1.23.0, 1.24, 1.24.0, 1.25.7 across the tree —
which is why a partial bump was enough to break the build.

What this does instead

Every module declares go 1.26.5. That is the highest any module required under the
bump, so one value satisfies the whole graph, and a single version means this drift cannot
recur module-by-module.

golangci-lint moves with it. The action was pinned at v6, which installs golangci-lint
v1.64.x — built with Go 1.24, and it refuses a newer target outright:

can't load config: the Go language version (go1.24) used to build golangci-lint
is lower than the targeted Go version (1.25.0)

So it goes to action v8 with an explicit version: v2.11.3, the first line supporting Go
1.26. Pinned explicitly rather than left to the action's default, so a future default shift
cannot silently reintroduce the same mismatch.

Verified locally

• All 17 modules build (go build ./..., checked on exit code)
• spicedb-go and spicedb-gen magefiles compile — the thing CI actually invokes
• go test ./... passes in both
• golangci-lint run ./... under v2.11.3: 0 issues

🤖 Generated with Claude Code