build: use Go 1.26.8 and preserve glibc 2.31 compatibility

[mswilkison]

The Go 1.24 Docker builders reject dependency updates that require Go 1.25.7, including the IPLD update discussed in #3991. Raise the module minimum to 1.25.7 and use Go 1.26.8 for the suggested toolchain, both Docker builders, and CI. Go 1.26 is the older supported release line; Go 1.25 left support when Go 1.27 shipped.

The source builder and runtime move to Alpine 3.23. The release builder retains Bullseye's C compiler and glibc 2.31, copying only Go from the official 1.26.8 image. This preserves cgo for native Linux/amd64 releases and compatibility with Debian 11 and Ubuntu 20.04. Both the client and tag-based release workflows now extract the actual Linux release archive and run the binary in both baseline containers before archiving or publishing it.

All setup-go jobs use v6 and read go.mod, including the vendored btcec and manual benchmark jobs; v6 honors the toolchain directive. The benchmark job now checks out the repository to read that file. Staticcheck moves to 2026.1 for Go 1.26 support.

This targets dev and implements the standalone toolchain step of #3991. All module dependency versions and go.sum remain unchanged; the issue's separate x/crypto, telemetry, and IPLD/libp2p reviews remain follow-ups.

Validation:

• The original PR's CI Linux release artifact fails at startup on both Debian 11 and Ubuntu 20.04 with missing GLIBC_2.32 and GLIBC_2.34 symbols, confirming that the added check detects the regression.
• The updated Linux/amd64 builder reports Go 1.26.8, glibc 2.31, and CGO_ENABLED=1.
• CI on the final commit passes the full Go unit suite, coverage gate, Docker runtime build, Linux/macOS release packaging, and startup of the rebuilt Linux archive on both Debian 11 and Ubuntu 20.04. Formatting, vet, Staticcheck, gosec, and vendored btcec verification/tests also pass.
• Workflow YAML, the compatibility step's Bash syntax, Go 1.26.8 formatting, and git diff --check pass.
• The separate client integration job also passes. All applicable CI checks are green on 97b4e1ce5a26a6db467f322e619de059d844b61d.

References: Go release policy and versions, Staticcheck 2026.1.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a33646f8-0602-4d67-a543-7772a3ad3418

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}