chore(deps): refresh build tooling

[steipete]

Summary

• update Go to 1.26.4 and pnpm to 11.9.0
• refresh setup-go, golangci-lint-action, and goreleaser-action to current stable releases
• migrate GoReleaser archive settings away from deprecated fields and ignore local dist/ output
• align README and unreleased changelog metadata

Upstream checks

• Go stable: https://go.dev/dl/
• setup-go 6.5.0: https://github.com/actions/setup-go/releases/tag/v6.5.0
• golangci-lint-action 9.3.0: https://github.com/golangci/golangci-lint-action/releases/tag/v9.3.0
• goreleaser-action 7.2.3: https://github.com/goreleaser/goreleaser-action/releases/tag/v7.2.3
• GoReleaser archive migration: https://goreleaser.com/resources/deprecations/
• pnpm 11 migration: https://pnpm.io/11.x/migration

Proof

• go test ./...
• go test -race ./...
• go vet ./...
• core coverage: 85.1%
• golangci-lint run ./...
• go mod verify
• govulncheck ./...: no vulnerabilities
• pnpm 11.9.0 frozen install, test, and lint
• actionlint
• goreleaser check
• goreleaser release --snapshot --clean: all six configured platform archives built
• autoreview: clean after removing generated snapshot artifacts from the change bundle

Risk

Low. Runtime source and public behavior are unchanged; risk is limited to CI/release tooling compatibility. The exact tool versions and full snapshot packaging path passed locally.

[steipete]

Landed as ed04e39.

Proof on PR head 8ebdd1109693a2a6997f688ba27d324cf68dee4a:

• go test ./...
• go test -race ./...
• go vet ./...
• core coverage: 85.1%
• golangci-lint run ./...
• go mod verify
• govulncheck ./...: no vulnerabilities
• pnpm 11.9.0 frozen install, test, and lint
• actionlint
• goreleaser check
• goreleaser release --snapshot --clean: built all six configured platform archives and checksums
• autoreview: clean after one accepted generated-artifact finding was fixed
• exact-head CI: https://github.com/steipete/eightctl/actions/runs/28507261115 passed, including lint/test/coverage; GitGuardian passed

No external Eight Sleep API call was required because this PR changes only toolchain, CI, release packaging, and documentation metadata; the built snapshot artifacts are the live boundary for the change.