ci: bump Go toolchain 1.26.1 → 1.26.2 (fix govulncheck CVEs)

govulncheck reported the following stdlib CVEs against Go 1.26.1 in the
Security Scan job:

  GO-2026-4866  crypto/x509  excludedSubtrees case-sensitivity auth bypass
  GO-2026-4870  crypto/tls   TLS 1.3 KeyUpdate DoS
  GO-2026-4946  crypto/x509  inefficient policy validation
  GO-2026-4947  crypto/x509  unexpected chain-building work

All fixed in go1.26.2. Bumped:

  go.mod                                go 1.26.1 → 1.26.2
  .github/workflows/ci.yml              GO_VERSION 1.25.7 → 1.26.2
  .github/workflows/fresh-clone-ci.yml  GO_VERSION 1.25.7 → 1.26.2

Matrix test-matrix entry also bumped 1.25.7 → 1.26.2.

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
 
 env:
-  GO_VERSION: '1.25.7'
+  GO_VERSION: '1.26.2'
 
 jobs:
   lint:
@@ -49,7 +49,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        go-version: ['1.25.7']
+        go-version: ['1.26.2']
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/fresh-clone-ci.yml

@@ -14,7 +14,7 @@ on:
   workflow_dispatch:
 
 env:
-  GO_VERSION: '1.25.7'
+  GO_VERSION: '1.26.2'
 
 jobs:
   fresh-clone-test:

go.mod

@@ -1,6 +1,6 @@
 module github.com/luxfi/pulsar
 
-go 1.26.1
+go 1.26.2
 
 require (
 	github.com/luxfi/lattice/v7 v7.1.0