security: clear all 194 Dependabot alerts, fix CI scanner failures, pin Go 1.26.5

[parlakisik]

Clears all 194 open Dependabot alerts on main, plus the govulncheck and Trivy failures that were already red on main before this branch.

Commit 1 — the Dependabot alerts

The alert count is inflated because GitHub opens one alert per advisory × manifest; they collapse to three packages across 18 Go modules.

Package	From	To	Modules
golang.org/x/crypto	v0.45–v0.51	v0.52.0	13
google.golang.org/grpc	v1.80.0	v1.82.1	14
go.mongodb.org/mongo-driver	v1.13.1–v1.17.6	v1.17.7	11

Severity cleared: 91 critical, 40 high, 63 medium.

Commit 2 — the CI scanner failures

govulncheck and Trivy were failing on every recent main run, including d473635, the commit this branch forked from. Those failures were not introduced here — main already carried x/text v0.37.0 and otel v1.43.0.

Package	From	To	Advisory
golang.org/x/text	v0.37.0	v0.39.0	GO-2026-5970 / CVE-2026-56852 — the only Trivy finding, and reachable via mongo.Connect → norm.Form.String
go.opentelemetry.io/otel	v1.43.0	v1.44.0	GO-2026-5158 (baggage header length)
go.opentelemetry.io/otel	v1.24.0	v1.44.0	same, internal/httpclient
golang.org/x/net	v0.55.0	v0.56.0	GO-2026-5942
github.com/klauspost/compress	v1.16.7 / v1.17.2	v1.18.7	GO-2026-5841

x/net and klauspost/compress were unreachable, so govulncheck tolerated them — but both have published fixes, and Trivy runs ignore-unfixed: true with severity: CRITICAL,HIGH, so they would fail the build once its DB caught up. Bumped pre-emptively.

Go toolchain → go1.26.5

GO-2026-5856 (stdlib crypto/tls, ECH privacy leak) is fixed by the toolchain, not a go.mod edit:

• toolchain go1.26.5 added to 23 go.mod files
• 13 Dockerfiles: golang:1.26-alpine → golang:1.26.5-alpine
• ci.yml + security.yml: GO_VERSION '1.26' → '1.26.5'

The go directives (a spread of 1.22 / 1.24.0 / 1.25.0) are deliberately left alone — unifying them drops support for older toolchains and is a separate compatibility decision.

AP2 submodule

• Pointer advanced eb2684d → e1ea56d (v0.2.0-4-ge1ea56d)
• .gitmodules added. It was missing entirely, so every CI job failed cleanup with fatal: No url found for submodule path 'AP2' in .gitmodules
• Dropped the contradictory AP2/ line from .gitignore

⚠️ Upstream has not patched AP2's own Go deps. At both the old and new pins they are identical: x/crypto v0.43.0, grpc v1.76.0, otel v1.37.0, x/text v0.30.0. The 9 upstream commits are docs, the v0.2.0 release, and a path move with 0 insertions(+), 0 deletions(-) to the go.mod. Fixing them requires a PR to google-agentic-commerce/AP2. Note this was never contributing to the alert count — Dependabot does not scan submodule contents.

Verification

• No Go source changes were required. semconv/v1.24.0 still exists in otel v1.44.0, and the mongo-driver v1.13/v1.14 → v1.17 jump needed no API adaptation.
• go build ./..., go vet ./..., go test -count=1 ./... — pass in all 23 modules under go1.26.5
• govulncheck — "No vulnerabilities found" in aex-gateway, aex-settlement, aex-work-publisher, and internal/testutil, scanning against the go1.26.5 standard library

Known residual

golang.org/x/crypto v0.52.0 carries GO-2026-5932 with no published fix (Fixed in: N/A). It is unreachable, and Trivy's ignore-unfixed: true skips it. Nothing to do until upstream ships a patch.