Upgrade Go toolchain to 1.26.5

.project/STATUS.md

@@ -2,13 +2,13 @@
 
 **Updated:** 2026-07-22
 **Branch:** main
-**Last Commit:** 09f51d1 - Add queued email notifications for collaboration events
+**Baseline Commit:** 4454e91 - Add Cloudflare email and collaboration workflows
 
 ## Quick Stats
 
 | Metric | Value |
 |--------|-------|
-| Total Tracked Files | 201 |
+| Total Tracked Files | 208 |
 | Go Files | 63 |
 | Swift Files | 15 (macOS app and package manifest) |
 | Go Test Files | 18 |
@@ -19,8 +19,10 @@
 
 - `go test -coverpkg=./... -coverprofile=... ./...` passes with 52.4% aggregate statement coverage.
 - `swift build` passes for the macOS app and CLI.
-- Focused race tests pass for email, collaboration, and HTTP packages. A full `go test -race ./...` exceeds the current five-minute local timeout.
-- `govulncheck` currently fails because Go 1.24.2 has 31 reachable standard-library vulnerabilities; the pinned Go toolchain must be upgraded before production sign-off.
+- `go test -race ./...` passes under Go 1.26.5.
+- Go is pinned consistently to 1.26.5 for local, CI, module, workspace, and container builds.
+- `govulncheck@latest` reports no reachable vulnerabilities.
+- The `golang:1.26.5-bookworm` production image builds successfully.
 - Highest package coverage: Markdown 87.0%, email 77.9%, store 70.0%, config 67.9%, auth 54.9%, and sync 54.2%.
 - Collaboration, configuration, email-provider, and collaboration HTTP integration tests are present; database, logging, and realtime still lack direct suites.
 
@@ -61,7 +63,6 @@ Milestone 4 collaboration completion:
 
 ## Known Gaps Requiring Human Review
 
-- Go 1.24.2 is below the patched versions reported by `govulncheck`, including fixes for `html/template`, `crypto/tls`, `net/http`, and `crypto/x509` vulnerabilities.
 - WebSocket broadcasts are authenticated but not filtered by per-document permissions.
 - Content-hash downloads are not tied back to effective document permission.
 - Browser caches are not cleared on logout.