fix: Native CLI builds use the patched Go runtime

[hatayama]

Summary

• Build the native CLI with Go 1.26.5 instead of Go 1.26.4.
• Restore the Go CLI security scan after the publication of GO-2026-5856.

User Impact

• Future native CLI builds use the patched crypto/tls standard library.
• This removes the newly reported Encrypted Client Hello privacy leak from code paths that download dispatcher files over HTTPS.

Changes

• Update the repository's patch-level Go toolchain source of truth in cli/.go-version.
• Keep go.mod and go.work at go 1.26; they intentionally declare only the language/toolchain minor version.
• No release-input stamps are required because cli/.go-version is outside the shared input trigger rules.

Verification

• go version reports go1.26.5 darwin/arm64.
• scripts/check-go-cli.sh passed for all Go modules and native dist verification.
• scripts/test-go-cli-toolchain.sh passed.
• govulncheck ./... reported No vulnerabilities found for cli/common, cli/dispatcher, cli/project-runner, and cli/release-automation.
• Confirmed the previous security failure reproduced on the v3-beta base and was not caused by the concurrent C# refactor PR.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• cli/.go-version is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 449764c4-3f76-4925-a788-1d2378eb1fd3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/hatayama/upgrade-go-1-26-5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 1 file

_{You’re at about 93% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

_{Re-trigger cubic}