[B] Make the Go CVE gate blocking (bump go 1.26.4 + golang.org/x/net, remove continue-on-error)

[gnanirahulnutakki]

Part of #64

PR #54 added govulncheck to CI but with continue-on-error: true, making it non-blocking. This task:

1. Remove continue-on-error: true from the govulncheck CI step.
2. Bump the Go toolchain to 1.26.4 (or current stable).
3. Bump golang.org/x/net to clear any known CVEs.

The gate must fail the build on new CVEs, not just report them.

[gnanirahulnutakki]

Deep-review reconciliation on current dev (7834cc539b04335a298451400530b40a423a3c29): all acceptance criteria are complete.

• PR ci: make go-cve gate blocking (remove continue-on-error) #84 removed continue-on-error from the go-cve job and merged as 6d3525cade59b2e0e85dd0e3753e61d33bec9f67.
• PR fix(ci): bump Go toolchain to 1.26.5 #183 moved the module, CI, mirrors, and demo builder to Go 1.26.5 and merged as baad9bc84ecd00b5db610013c1cdbfa950cfda3c.
• golang.org/x/net is now v0.56.0, newer than the vulnerable ranges that motivated this issue.
• .github/workflows/tests.yml runs pinned govulncheck@v1.1.4 directly, without a soft-failure flag.
• The aggregate protected tests job explicitly requires go-cve == success.

Current execution evidence:

• Exact-SHA CI run: https://github.com/ArdurAI/ardur/actions/runs/29164935870
• Go CVE job: https://github.com/ArdurAI/ardur/actions/runs/29164935870/job/86576322822 (success)
• Aggregate tests job: https://github.com/ArdurAI/ardur/actions/runs/29164935870/job/86576520315 (success)
• Local pinned scan on the same tree: govulncheck@v1.1.4 ./... exited 0 with 0 reachable vulnerabilities.
• Workflow parse validation: actionlint -shellcheck= .github/workflows/tests.yml passed.

The verbose local scan reports one module-only advisory, GO-2026-5932, for the unmaintained golang.org/x/crypto/openpgp package. Ardur does not import that affected package and no vulnerable package or symbol is reachable; the advisory has no fixed module version. This does not weaken the blocking reachable-vulnerability gate.

Closing as completed; no new code change is warranted.