chore: upgrade Go from 1.25.7 to 1.26.5

Go 1.26.5 released Jul 7, 2026. Includes security fix for GO-2026-5856 (crypto/tls ECH leak). Updates: CI runner (4x setup-go), go.mod, README, obsidian docs.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

obsidian/Crussell/Overview.md

@@ -1,6 +1,6 @@
 # Crussell — Overview
 
-Full-stack booking platform for a UK sole-trader nail artist. Go 1.25 backend, SvelteKit 5 SPA frontend, PostgreSQL 17, Docker Compose. UK-only (Cloudflare geo-blocks non-UK). All timestamps UTC-normalised — the backend's `clock.Now()` returns `time.Now().UTC()`, the DB connection uses `timezone = "UTC"`, and the frontend converts between UTC and the browser's local wall-clock time via `formatLocalDateTime()` / `parseWallClockDate()`. No timezone conversion ambiguity — times shown are always UK wall-clock times.
+Full-stack booking platform for a UK sole-trader nail artist. Go 1.26.5 backend, SvelteKit 5 SPA frontend, PostgreSQL 17, Docker Compose. UK-only (Cloudflare geo-blocks non-UK). All timestamps UTC-normalised — the backend's `clock.Now()` returns `time.Now().UTC()`, the DB connection uses `timezone = "UTC"`, and the frontend converts between UTC and the browser's local wall-clock time via `formatLocalDateTime()` / `parseWallClockDate()`. No timezone conversion ambiguity — times shown are always UK wall-clock times.
 
 ---
 
@@ -136,7 +136,7 @@ Campaign lifecycle: `draft → active → completed` (or any → `cancelled`, `a
 | Tool | Version | Notes |
 |------|---------|-------|
 | Docker & Docker Compose | >= 20.10 | Compose V2 (`docker compose`, not `docker-compose`) |
-| Go | >= 1.22 | Tested with 1.25 |
+| Go | >= 1.22 | Tested with 1.26.5 |
 | Node | >= 18 | For frontend build |
 | tmux | >= 3.0 | For local-dev-2.sh dev helper |
 | psql | Any | Optional — for direct DB inspection during dev |