fix(docker): pin Go builders to 1.26.5 and set GOTOOLCHAIN=auto

The official golang images set GOTOOLCHAIN=local, so a base older than the
governing go.mod `go` directive fails hard instead of fetching a toolchain:

    go: go.mod requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local)

docker/Dockerfile.multi-node sat on golang:1.24.5-alpine, two minor versions
under the root go.mod floor of 1.26.4. Dockerfile, deploy/testnet/Dockerfile
and Dockerfile.dvenue were at 1.26.4 — exactly at the floor, with no headroom.

Two orthogonal halves:

  1. pin every Go builder base to the latest stable patch, 1.26.5, so the
     images carry current compiler and stdlib security fixes;
  2. set GOTOOLCHAIN=auto in every Go builder stage, so a future floor bump
     downloads a checksum-verified toolchain rather than hard-failing.
     Dockerfile and deploy/testnet already had it; multi-node and dvenue
     did not.

Half 2 is not hypothetical here: sdk/lx-trading-go/go.mod already declares
go 1.26.5, above the root module's 1.26.4, so a submodule build under
GOTOOLCHAIN=local would die at exactly this error.

The root `go` directive stays at 1.26.4 on purpose — raising it pushes a hard
patch-level floor onto every consumer. A newer toolchain building an older
directive is always valid.

docs/Dockerfile is untouched: it builds static docs and compiles no Go.

Co-authored-by: Hanzo Dev <[email protected]>

Dockerfile

@@ -12,7 +12,10 @@
 #   docker run … plugin     run as a luxd rpcchainvm plugin (luxd execs it)
 #   docker run … version    print the plugin version line
 # ---------------------------------------------------------------------------
-ARG GO_VERSION=1.26.4
+# Must be >= the `go` directive in go.mod (1.26.4); pinned to the latest stable
+# patch so the image ships current compiler/stdlib security fixes. GOTOOLCHAIN
+# below stays `auto` so a future floor bump downloads rather than hard-fails.
+ARG GO_VERSION=1.26.5
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends \

Dockerfile.dvenue

@@ -34,7 +34,9 @@
 # That tarball carries lux-gpu.pc and lux-crypto-secp256k1.pc plus their
 # libs/headers under a GNU prefix.
 # ---------------------------------------------------------------------------
-ARG GO_VERSION=1.26.4
+# Must be >= the `go` directive in go.mod (1.26.4); pinned to the latest stable
+# patch so the image ships current compiler/stdlib security fixes.
+ARG GO_VERSION=1.26.5
 # CUDA 12.x devel image (arm64/sbsa variant) provides nvcc-free libcudart for
 # the cgo link of dexd. Runtime stage uses the matching -runtime image.
 ARG CUDA_VERSION=12.4.1
@@ -56,6 +58,11 @@ RUN wget -q "https://go.dev/dl/go${GO_VERSION}.linux-arm64.tar.gz" \
     && rm "go${GO_VERSION}.linux-arm64.tar.gz"
 ENV PATH="/usr/local/go/bin:${PATH}"
 
+# A go.mod `go` directive newer than the toolchain above is a hard failure
+# under GOTOOLCHAIN=local. `auto` lets go fetch the required toolchain
+# (checksum-verified via sum.golang.org) instead of dying at the floor.
+ENV GOTOOLCHAIN=auto
+
 # luxfi module resolution: skip checksum DB (tags may be rewritten), proxy for
 # public deps, direct for luxfi/*.
 ENV GONOSUMCHECK=github.com/luxfi/*

deploy/testnet/Dockerfile

@@ -19,7 +19,10 @@
 # Dockerfile.dvenue (spark only, needs the private luxcpp dep tarball). The CPU
 # image here is the canonical, portable testnet path; see README.md "GPU".
 # ---------------------------------------------------------------------------
-ARG GO_VERSION=1.26.4
+# Must be >= the `go` directive in go.mod (1.26.4); pinned to the latest stable
+# patch so the image ships current compiler/stdlib security fixes. GOTOOLCHAIN
+# below stays `auto` so a future floor bump downloads rather than hard-fails.
+ARG GO_VERSION=1.26.5
 FROM golang:${GO_VERSION}-bookworm AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends \

docker/Dockerfile.multi-node

@@ -1,5 +1,10 @@
 # Multi-stage build for LX multi-node
-FROM golang:1.24.5-alpine AS builder
+FROM golang:1.26.5-alpine AS builder
+
+# The golang images set GOTOOLCHAIN=local, which turns a go.mod `go` directive
+# newer than this base into a hard build failure. `auto` lets go fetch the
+# required toolchain (checksum-verified via sum.golang.org) instead.
+ENV GOTOOLCHAIN=auto
 
 # Install build dependencies
 RUN apk add --no-cache \