STAC-25449: remediate backup CLI release CVEs

[LouisLotter]

Summary

• move release builds to Go 1.26.5 and update the vulnerable AWS SDK, OpenTelemetry, x/crypto, x/net, x/sys, x/text, klauspost/compress, and spdystream dependency families
• add a blocking govulncheck plus VEX-aware Trivy/Grype scan of all five GoReleaser snapshot archives before tag publication
• verify GoReleaser checksums, target OS/architecture, and the embedded Go toolchain for every scanned archive
• pin Actions and CI tools, apply least-privilege permissions, disable implicit caches, and make security coverage visible in the check name

Jira: STAC-25449

Security result

The local snapshot build produced and verified macOS amd64/arm64, Linux amd64/arm64, and Windows amd64 archives. With refreshed Trivy and Grype databases plus both StackVista and Rancher VEX hubs:

• Critical: 0
• High: 0
• Medium: 0
• Low: 0
• Secrets: 0
• UNKNOWN: GO-2026-5932 once per platform

GO-2026-5932 applies to the deprecated golang.org/x/crypto/openpgp package. The CLI requires the parent module but does not import or link the affected package. govulncheck -show verbose reports it only at module level and reports zero reachable vulnerabilities and zero package-level vulnerabilities. The artifact scanners deliberately retain this UNKNOWN evidence; it is not hidden by an exception.

Validation

• go test ./...
• golangci-lint run --config=.golangci.yml ./...
• go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
• go mod verify
• goreleaser check with v1.25.1
• full GoReleaser snapshot build and SHA-256 verification for all five archives
• embedded toolchain and GOOS/GOARCH verification for every archive
• Trivy secret scan: zero findings
• VEX-aware Trivy and Grype artifact scans: zero scored findings
• image-pipeline gate evaluation: passed with zero in-scope findings
• shellcheck scripts/prepare-artifact-scan-rootfs.sh
• workflow YAML parse and git diff --check
• uvx zizmor --collect=workflows,actions,dependabot .: no findings

Follow-up after merge

Publish the next immutable release, confirm the recurring cve-reporter target advances from v0.8.2, and re-scan all five release assets. The independent StackGraph v2 feature PR can then rebase or merge main to absorb this security baseline.