chore(security): fix stdlib + x/text CVEs (Go 1.26.7, x/text 0.41.0)

[skipi]

Problem

The security checks on master are red. The latest daily build reports 14 vulnerabilities across the Check dependencies and Check docker jobs:

CVE	Component	Source
CVE-2026-33818	encoding/asn1	stdlib
CVE-2026-39822	os (os.Root symlink traversal)	stdlib
CVE-2026-56853	net/http (unencrypted HTTP/2 DoS)	stdlib
CVE-2026-56858	html/template	stdlib
CVE-2026-56859	encoding/xml	stdlib
CVE-2026-56860	net/url	stdlib
CVE-2026-56862	crypto/tls	stdlib
CVE-2026-39821	golang.org/x/net/idna	stdlib (vendored)
CVE-2026-46600	golang.org/x/net/dns/dnsmessage	stdlib (vendored)
CVE-2026-56852	golang.org/x/text	module
—	net/textproto, mime, crypto/x509, crypto/tls ECH	stdlib

Cause

Two independent causes:

1. The Go toolchain. CI and the release pipeline pin sem-version go 1.26.4. make docker.build compiles the agent with that toolchain and Dockerfile.self_hosted copies the binary in, so the scanned image carries 1.26.4's standard library. Every stdlib finding above is fixed by a toolchain no later than go1.26.6.

2. golang.org/x/text at v0.38.0, fixed in v0.39.0.

Worth noting for review: the two golang.org/x/net rows are not module findings. golang.org/x/net/idna and golang.org/x/net/dns/dnsmessage are vendored into the Go standard library for net/http and DNS resolution, and that vendored copy is what is flagged. The x/net module dependency is already past both fixes at v0.56.0 (they landed in v0.55.0 and v0.56.0 respectively), so it needs no change here.

Fix

• Move all eight Go pins from 1.26.4 to 1.26.7 — seven in .semaphore/semaphore.yml, one in .semaphore/release.yml. 1.26.7 is the latest 1.26.x patch and clears every finding with margin (the highest required is 1.26.6).
• Bump golang.org/x/text from v0.38.0 to v0.41.0.

No source changes.

Verification

govulncheck -scan module before and after, on this branch:

# before (go1.26.3 toolchain, x/text v0.38.0)
Your code may be affected by 14 vulnerabilities.

# after (go1.26.7 toolchain, x/text v0.41.0)
No vulnerabilities found.

go build ./..., go vet, and the unit tests pass.

One thing I could not verify locally: that sem-version go 1.26.7 resolves on the agent image — change-go-version lives in the VM image rather than in semaphoreci/toolbox. CI will confirm this in the first prologue command; if 1.26.7 is not yet available there, 1.26.6 is the minimum that still clears every finding.