deps: update all modules, bump go and builder images to 1.26.7

Update every direct dependency across all five workspace modules to
latest. Notable jumps: syft v1.43.0 -> v1.51.1, grype v0.111.1 ->
v0.118.0, stereoscope v0.1.23 -> v0.3.1, indigo -> 2026-09-01,
aws-sdk-go-v2/service/s3 v1.99.1 -> v1.110.0, grpc v1.80.0 -> v1.83.2,
x/crypto v0.50.0 -> v0.55.0.

Three deps needed more than a version bump:

go-libipfs could not be updated at all. The repo was renamed to boxo, so
every tag past v0.7.0 declares `module github.com/ipfs/boxo` and cannot
be required under the old path. sqlite_store.go already imported
go-block-format alongside it and used the archived package exactly once,
inside a function already returning blockformat.Block, so it was relying
on structural interface satisfaction. Collapsing to the native type drops
the archived dependency entirely.

go-didplc moved its package from the repo root into a didplc/ subdir in
v0.2.2. Package name is unchanged and every symbol we use (RegularOp,
OpEnum, OpService, Client.DirectoryURL, Submit) is intact, so this is an
import path change only.

The go-diskfs replace in scanner/go.mod had inverted. It pinned v1.7.0
because syft v1.43 passed diskfs entries as os.FileInfo; syft v1.51.1
fixed that upstream and now requires v1.9.4, so the workaround had become
the thing breaking the build. Removed per its own "Remove when syft ships
a fix" note, closing anchore/syft#4796 for us.

The indigo bump needed no code changes: of the 21 packages we import only
5 changed, and the repo/MST/CAR-store core is byte-identical. It does
bring a util/ssrf fix blocking 6to4 addresses (2002::/16), which we
inherit through atproto/auth/oauth.

Go 1.26.7 across go.work, all five go.mod files, the four Dockerfiles,
the three tangled workflows, and the stale references in
docs/DEVELOPMENT.md. Verified golang:1.26.7-trixie resolves on
mirror.gcr.io, which is what the Dockerfiles actually pull from.

Makefile's TRIXIE_BUILDER_IMAGE stays on the floating golang:1-trixie.

make test, make lint, and make test-race all pass, as do the scanner
module's tests and the integration-tagged build.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KWoKzpgtBJ33sCyGxJGR7x

docs/DEVELOPMENT.md

@@ -51,7 +51,7 @@ binary.
                   │ (changes appear in container)
                   ▼
 ┌─────────────────────────────────────────────────────┐
-│ Container (mirror.gcr.io/library/golang:1.26.2)     │
+│ Container (mirror.gcr.io/library/golang:1.26.7)     │
 │                                                      │
 │  ┌──────────────────────────────────────┐           │
 │  │ Air (github.com/air-verse/air)        │           │
@@ -78,7 +78,7 @@ mounted tree every 500ms instead.
 
 | File | Purpose |
 |------|---------|
-| `Dockerfile.dev` | Single dev image used by all three services. `golang:1.26.2-trixie` base with Air, Node/npm, and SQLite installed. Source comes from a volume mount, not `COPY`. Accepts an `AIR_CONFIG` build arg to select which `.air.*.toml` to run. |
+| `Dockerfile.dev` | Single dev image used by all three services. `golang:1.26.7-trixie` base with Air, Node/npm, and SQLite installed. Source comes from a volume mount, not `COPY`. Accepts an `AIR_CONFIG` build arg to select which `.air.*.toml` to run. |
 | `docker-compose.yml` | The dev compose file (this *is* the primary compose file — there is no separate `docker-compose.dev.yml`). Defines `atcr-appview`, `atcr-hold`, `atcr-labeler`, and `victorialogs`, all on a fixed `172.28.0.0/24` network. |
 | `.air.toml` | AppView Air config (default `AIR_CONFIG`). |
 | `.air.hold.toml` | Hold Air config (selected via `AIR_CONFIG=.air.hold.toml`). |
@@ -88,7 +88,7 @@ mounted tree every 500ms instead.
 
 ```dockerfile
 # Development image with Air hot reload
-FROM mirror.gcr.io/library/golang:1.26.2-trixie
+FROM mirror.gcr.io/library/golang:1.26.7-trixie
 
 ARG AIR_CONFIG=.air.toml
 
@@ -282,7 +282,7 @@ go build -tags billing -o bin/atcr-appview ./cmd/appview
 ```
 
 Running on the host requires a working toolchain for the build:
-Go 1.26.2 (see `go.work`), Node/npm (for the `go generate` asset step), and
+Go 1.26.7 (see `go.work`), Node/npm (for the `go generate` asset step), and
 SQLite headers. Override config values with the `ATCR_*` env vars listed above,
 or edit your local config file.