fix: rebuild plural CLI with Go 1.26.5

[plural-copilot]

Summary

• rebuild the plural CLI image and binary with Go 1.26.5+
• update the module Go version so setup-go based CI jobs also use Go 1.26.5
• align test/helper containerized Go pins with the same toolchain version

Why

This remediates the mapped Go stdlib vulnerabilities affecting the ghcr.io/pluralsh/plural-cli artifact embedded in mgmt/console.

Details

• Dockerfile now builds from golang:1.26.5-alpine3.24 in both build stages
• go.mod now declares go 1.26.5, which makes repo workflows using go-version-file: go.mod install Go 1.26.5
• test.Dockerfile and helper scripts now use Go 1.26.5 for consistency
• 1.26.5-alpine3.22 is not published upstream, so the smallest working image update is 1.26.5-alpine3.24

Plural Service: mgmt/console

Verification

• verified published upstream tags exist for golang:1.26.5, golang:1.26.5-bookworm, and golang:1.26.5-alpine3.24
• ran docker build against the updated Dockerfile and confirmed the build resolves the Go 1.26.5 base image and progresses through module download and CLI compile steps

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create a remediation PR in this repository to fix owned fixable vulnerabilities for the mgmt/console service that map here....
🔗 Run history	View run history

[greptile-apps]

Greptile Summary

This PR remediates Go stdlib vulnerabilities in the ghcr.io/pluralsh/plural-cli artifact by bumping the Go toolchain from 1.26.4 to 1.26.5. All relevant pins are updated consistently — Docker build stages, go.mod, test infrastructure, and helper scripts.

• Dockerfile: both the builder and final stages move from golang:1.26.4-alpine3.22 to golang:1.26.5-alpine3.24 (alpine3.22 is not published for 1.26.5 upstream, so the base OS is also incremented to 3.24).
• go.mod: the go directive is updated to 1.26.5, ensuring CI workflows using go-version-file: go.mod pick up the correct toolchain.
• hack/lib.sh / hack/gen-client-mocks.sh / test.Dockerfile: helper and test images aligned to golang:1.26.5 / golang:1.26.5-bookworm.

Confidence Score: 5/5

Mechanical version bump with no logic changes; all updated image tags are confirmed to exist upstream.

Every changed line is a Go toolchain version string — from 1.26.4 to 1.26.5. The bump is applied consistently across Dockerfiles, go.mod, and helper scripts. The golang:1.26.5, golang:1.26.5-alpine3.24, and golang:1.26.5-bookworm Docker Hub tags are confirmed to exist. There are no logic, configuration, or dependency changes that could introduce regressions.

No files require special attention. The alpine base OS bump from 3.22 to 3.24 in the Dockerfile is expected and necessary since golang:1.26.5-alpine3.22 is not published upstream.

Important Files Changed

Filename	Overview
Dockerfile	Both builder and final stages updated from golang:1.26.4-alpine3.22 to golang:1.26.5-alpine3.24; confirmed upstream tag exists
go.mod	Go toolchain directive bumped from 1.26.4 to 1.26.5, aligning CI setup-go jobs with the new version
hack/gen-client-mocks.sh	CONTAINERIZE_IMAGE updated from golang:1.26.4 to golang:1.26.5 for consistency
hack/lib.sh	Default containerize image fallback bumped from golang:1.26.4 to golang:1.26.5
test.Dockerfile	Test image base updated from golang:1.26.4-bookworm to golang:1.26.5-bookworm for consistency

_{Reviews (1): Last reviewed commit: "fix: rebuild plural CLI with Go 1.26.5" | Re-trigger Greptile}