chore: bump Go to 1.26.4 and update dependencies

[jlagedo]

Summary

Bumps the Go toolchain and dependencies to clear the stdlib and golang.org/x/crypto advisories reported by osv-scanner, and updates CI accordingly.

• Go directive 1.24.0 → 1.26.4 in all modules (root + 3 examples). Clears the stdlib advisories osv-scanner flagged against the declared 1.24.0 version.
• golang.org/x/crypto 0.46.0 → 0.52.0 (x/sys 0.39.0 → 0.45.0 via tidy). Clears GO-2026-5013/5017/5018/5019/5020. This is a test-only dependency (imported only in virtualization_test.go and internal/testhelper/ssh.go; go mod why reports the main module doesn't need it), bumped for downstream scanner hygiene.
• 4 go vet printf fixes (buf → buf.String()) in shared_directory_test.go and socket_test.go. These were latent (%q on a bytes.Buffer value) and are surfaced by the stricter printf analyzer once the go directive is raised; without the fix go vet ./... fails CI.
• CI matrix (build + test jobs) updated to ^1.26.

Verification

Run locally on macOS arm64 with go1.26.4:

• go vet ./... — clean
• go build ./... — library + all 3 example modules build
• Codesigned VM integration suite (go test -exec "go run cmd/codesign" .) — passes, boots real Linux guests

Notes

• Go 1.26 is the last release supporting macOS 12; this keeps macOS 12 host support (1.27 would drop it).

🤖 Generated with Claude Code

[cfergeau]

This forces anyone who wants to use Code-Hex/vz to switch to go 1.26.4 or newer, which can be complicated in some cases (eg IT controlled environment, …).
Imo it’s up to the modules using Code-Hex/vz to ensure they are using up to date go versions with no known vulnerability rather than Code-Hex/vz forcing them to do so. If Code-Hex/vz starts doing this, this means it will have to constantly update go 1.26.4 to the latest version.
I’d stick to 1.25.0 for this line as 1.25 is still supported (but you have to use latest 1.25 when building)

[jlagedo]

it's a nice question to be decided, my daily work is in a high regulated it env and everyone is pushing closing cves to the max, but its really something that needs feedback