Bump go-git to alpha.5 and Go to 1.26.6, add govulncheck to CI

govulncheck reported 12 vulnerabilities reachable from git-sync's own call graph. This clears all of them.

go-git v6.0.0-alpha.5 fixes two advisories we call into:

• GO-2026-6214, path traversal via crafted reference names, reached where convert-sha256 writes advertised refs to disk via SetReference. Refs come from the source advertisement, so the input is remote-controlled.
• GO-2026-6213, worktree operations following symlinks.

Pulls go-billy to v6.0.0-alpha.2 transitively. No new modules, and both are already-allowed Apache-2.0.

Toolchain 1.26.6 clears ten standard-library advisories reachable from the HTTP transport and the convert-sha256 filesystem paths, including quadratic complexity in net/url resolvePath, an os root escape via symlink plus trailing slash, and an HTTP/2 infinite loop on a bad SETTINGS_MAX_FRAME_SIZE. Released binaries build from the go.mod toolchain, so they shipped with these. mise.toml is bumped in step, as its comment asks.

The new Vulnerability Scan workflow gates this going forward. The existing lint suite cannot see this class of issue. It runs on PRs and pushes plus a weekly schedule, because advisories are published against versions already in go.mod — without the schedule a fresh disclosure goes unreported until someone opens a PR. Symbol-level scan, so an advisory in an unreachable corner of a dependency does not block the queue.

Verified: go build ./... and go test ./... green under the new toolchain (16/16 packages), go mod tidy clean, and govulncheck ./... now reports 0 called vulnerabilities.