fix(runner): rebuild Go tools with patched compiler and network modules

[alvaroloes]

Runner image publication fails on critical/high findings in the embedded Go toolchain and golang.org/x/net. Rebuild the existing checksum-pinned tool releases with digest-pinned Go 1.26.9 and resolve x/net v0.60.0 in every source build.

Docker CLI keeps its reviewed module graph in vendor.mod/vendor.sum; use that graph for the patched module build. runc also uses module resolution, and the final build audit verifies each binary's effective embedded x/net version alongside the existing compiler/module assertions. Tool release versions, source checksums and the image scanner policy/exceptions remain unchanged.

Validation:

• Linux CI passes pnpm verify, minimum-Node acceptance, the clean self-host build and actual Docker workspace E2E.
• Candidate image build, full scan and publication pass for every addressable image digest with the existing fixable high/critical CVE gate. These are commit-addressed candidates; the workflow does not deploy them.
• Locally, the unchanged Vercel bootstrap tests hit their five-second timeouts, and Docker builds encountered refused connections to upstream Go hosts. Linux acceptance passed without changing tests, timeouts, TLS or checksum checks.

References: blocked publication, Go release history, x/net v0.60.0.