docker: bump golang from 1.26.4-alpine to 1.26.5-alpine

[dependabot]

Bumps golang from 1.26.4-alpine to 1.26.5-alpine.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• golang migration image: 1.26.4-alpine@sha256:3ad573… → 1.26.5-alpine@sha256:0178a6…
• Reviewed head: 3ad2317e37a57238d087126e868a271adcb58da5

Security review

• Confirmed security update for CVE-2026-39822 (os.Root escape) and CVE-2026-42505 (ECH PSK identity privacy leak); Go's fixed range begins at 1.26.5.
• The pinned old and new values resolve exactly to the Docker Official Images OCI indexes. All eight platform manifests carry SPDX/SLSA attachments; the new image traces to docker-library/golang source revision 294097713ad2eaf9ee4c5e9dc57e040ac4b402d6.
• Official Go download checksums match every architecture. Alpine 3.24 base digests and package inventory are unchanged; the SBOM delta is Go/stdlib 1.26.4 → 1.26.5.
• No new downloader, install hook, runtime capability, credential access, telemetry, or endpoint was introduced.

Compatibility verification

• docker compose -f docker-compose.dev.yaml config --quiet — passed.
• make test — passed across the root, Pro, and packager modules under host Go 1.26.5.
• Required Go/JS CI and both public riverui architecture image builds passed.
• The riverproui job fails before build because Dependabot cannot assume the AWS OIDC role; it is not an image or dependency failure.

Residual risk

• A local Docker daemon was unavailable, so the exact image could not be pulled and the Compose migration container was not executed locally. Registry-bound provenance, per-platform manifests, upstream checksums, unchanged Alpine inventory, host-Go tests, and the remaining CI coverage make this a low residual packaging risk.