chore(deps): refresh toolchain and build tooling

[steipete]

Summary

• update the Go toolchain from 1.26.4 to 1.26.5, including current security fixes
• refresh supported indirect Go modules and pnpm from 11.9.0 to 11.12.0
• update the pinned GoReleaser version from 2.16.0 to 2.17.0 in CI and release automation
• keep README and changelog tooling documentation synchronized

Risk

Low: seven tooling, workflow, dependency, and documentation files; 31 insertions and 31 deletions. No Eight Sleep API or product-runtime path changed.

Validation

• make test
• make coverage — 85.1% core coverage
• go tool mvdan.cc/gofumpt -l . — clean
• golangci-lint v2.12.2 — 0 issues
• actionlint — clean
• govulncheck ./... — no vulnerabilities
• pnpm 11.12.0 frozen install, test, build, version, and help smoke tests
• GoReleaser 2.17.0 snapshot packaging for macOS, Linux, and Windows on amd64 and arm64; native artifact reported the exact snapshot version
• AutoReview — no accepted or actionable findings
• Public Model Identifier Gate — PASS across the exact diff, tracked files, workflows, tests, logs, proof, and packaged binaries

Authenticated Eight Sleep/device proof is not applicable because this changes only dependency, toolchain, workflow, and documentation boundaries.

Exact reviewed head: 757905c38b611e3ca8ffb3b1735a94998fe09c03.