Fix CI: correct the pinned Go toolchain SHA256

GO_SRC_SHA256 was wrong since it was first pinned in Task 1 — this
path had never actually been exercised in any prior CI run or local
test because every earlier failure happened before reaching the Go
install step, or (once it did run) nothing had checked the pinned
value against go.dev's own published checksum yet. Task 88's log
caught it: the real go1.26.5 linux-amd64 tarball hashes to
5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053
(cross-checked against https://go.dev/dl/?mode=json directly), not
the previously pinned value. Also independently re-verified
LIBSECCOMP_SRC_SHA256 against the real v2.6.1 tarball while looking at
this — that one was already correct.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/ci/buildenv-versions.env

@@ -16,7 +16,7 @@ GO_VERSION="1.26.5"
 GO_SRC_URL="https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
 # Checksum as published by go.dev itself (`curl -s https://go.dev/dl/?mode=json`)
 # — must be re-derived from the same source whenever GO_VERSION changes.
-GO_SRC_SHA256="88c162b204e6eefcc32499453b492e80209f4a4c78c33092636901c540fb0d05"
+GO_SRC_SHA256="5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
 
 # Rust toolchain (builds netavark, aardvark-dns) — installed via rustup
 # rather than a pinned tarball, since rustup itself provides reproducible,