CP-47356: Build on Go 1.26.7 to clear stdlib CVEs

[evan-cz]

Stacked on #1000 — review and merge that first. (Branch name predates the ticket split and carries the parent key; not worth churning the PR to rename.)

Repinning the bundled Alloy fixes only the binary vendored from elsewhere. The nine agent binaries and prometheus-config-reloader are compiled in this repository, so they keep whatever standard library their build image provides until it moves.

The stdlib version baked into a binary comes from the toolchain that built it, so the Dockerfiles are where this takes effect. The go directives move with them because scripts/ci-checks.sh treats the version in go.mod as the single source of truth and requires every Dockerfile and every module to agree — which is what keeps the toolchain from drifting apart across the four modules and three images.

Seven places, all enforced by that check:

go.mod, .tools/go.mod, tests/go.mod, tests/integration/test_server/go.mod	go 1.26.7
docker/Dockerfile, tests/docker/Dockerfile.smoke-tests, tests/integration/test_server/Dockerfile	golang:1.26.7

Precedent: f0d0829 (1.26.4 to 1.26.5) changed the identical seven files.

Verification. scripts/ci-checks.sh passes locally (exit 0). This clears the stdlib advisories but not the whole gate on its own — see the rest of the stack.

Stack: #1000 (Alloy) → #1001 (this) → #1003 (grype output) → #1004 (reloader)

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR synchronizes the repository’s Go toolchain version at 1.26.7 to ensure locally built binaries use the patched standard library.

• Updates all four Go module directives from 1.26.5 to 1.26.7.
• Updates all three Go builder images from 1.26.5 to 1.26.7.
• Preserves the version consistency required by scripts/ci-checks.sh.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
go.mod	Updates the canonical Go version to 1.26.7, matching every checked module and builder image.
.tools/go.mod	Aligns the development-tools module with the canonical Go version.
tests/go.mod	Aligns the test module with the canonical Go version.
tests/integration/test_server/go.mod	Aligns the integration test server module with the canonical Go version.
docker/Dockerfile	Builds production binaries and the reloader with the Go 1.26.7 Alpine image.
tests/docker/Dockerfile.smoke-tests	Builds production and smoke-test binaries with the Go 1.26.7 Alpine image.
tests/integration/test_server/Dockerfile	Builds the integration test server with the Go 1.26.7 image.

_{Reviews (8): Last reviewed commit: "CP-47356: Build on Go 1.26.7 to clear st..." | Re-trigger Greptile}

[evan-cz]

@greptileai review

[evan-cz]

Rebuilding against the re-tagged ghcr.io/cloudzero/alloy:v1.19.2-patch-1, which now carries the etcd v3.6.14 fix for GO-2026-6107. No change to this branch — the tag moved, the pin did not.