Bump x/crypto to v0.56.0 and adopt go 1.26.0

[tgrunnagle]

Summary

Why: two advisories were published against golang.org/x/crypto/ssh — GO-2026-6354 and GO-2026-6355, both channel-deadlock DoS bugs a malicious SSH peer can trigger. They fail the govulncheck security gate on every open PR and will fail main's next scheduled scan.

What:

• Bump golang.org/x/crypto v0.55.0 → v0.56.0 (the release that fixes both advisories).
• Move the go directive go 1.26 → go 1.26.0.
• Remove the "go.mod must pin Go to minor version" check in .github/workflows/lint.yml.

Reachability (severity context)

These are production-reachable, not test-only. govulncheck traces the vulnerable ssh.NewClientConn from our own code:

pkg/git.Clone
  → go-git CloneContext → … → transport/ssh.dial
    → golang.org/x/crypto/ssh.NewClientConn   (vulnerable)

pkg/git.Clone calls git.CloneContext, and go-git registers its SSH transport by default, so the vulnerable path is linked in and reachable whenever a repository is cloned over SSH (pkg/git exposes WithAuth(transport.AuthMethod), which accepts SSH auth). The dependency therefore cannot be removed without dropping go-git's SSH transport support — bumping to the patched release is the correct fix.

Why the go directive has to change (and the lint rule has to go)

x/crypto v0.56.0 declares go 1.26.0 in its own go.mod. Go's module rules require a consumer to declare a go version >= the maximum of its dependencies' go directives, so pulling v0.56.0 forces this module's go.mod to go 1.26.0 (patch-level).

That directly collides with lint.yml's guard:

! grep -qE '^go [0-9]+\.[0-9]+\.[0-9]+' go.mod || { echo 'ERROR: go.mod must pin Go to minor version ...'; exit 1; }

The two constraints cannot both hold: any go step (build, go mod tidy, codegen verify) rewrites the directive to 1.26.0, and the lint check then rejects it. Adopting go 1.26.0 and dropping the minor-version guard is the only way to consume the patched dependency. go mod tidy was re-run so go.sum is consistent under the new floor.

Type of change

• Bug fix (non-breaking change which fixes an issue)

Test plan

• govulncheck ./... locally: GO-2026-6354 and GO-2026-6355 no longer appear after the bump.
• go build ./... passes; go mod tidy leaves the tree clean under go 1.26.0.
• Only non-stdlib finding left is GO-2026-5932, already in IGNORED_VULNS.

Does this introduce a user-facing change?

No.

Special notes for reviewers — please confirm the approach

This PR makes a repo-wide policy change (the go directive floor and the removal of the minor-version lint guard), which is broader than a routine dependency bump. Please confirm you're comfortable with:

1. Raising the go directive to go 1.26.0. This sets a patch-level minimum for the whole module. It's transitively required by x/crypto v0.56.0 — there's no way to take the fix on go 1.26.
2. Removing the minor-version lint guard. That rule presumably existed to keep the patch toolchain floating via GOTOOLCHAIN; with a dependency now pinning a patch floor, the guard can no longer pass.

An ignore-list entry was considered and rejected: the vuln is reachable from production git-over-SSH (see Reachability above), so suppressing it would leave a real DoS path unaddressed. Removing the dependency was also investigated and isn't viable — it backs go-git's SSH transport.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.22%. Comparing base (2ad87a3) to head (5ae8258).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6494      +/-   ##
==========================================
+ Coverage   78.18%   78.22%   +0.03%     
==========================================
  Files         769      769              
  Lines       75049    75049              
==========================================
+ Hits        58680    58708      +28     
+ Misses      16364    16336      -28     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.