fix(deps): bump Go to 1.26.9 and x/net to v0.60.0 for new govulncheck advisories

Why

govulncheck is blocking, and since 2026-10-09 ~00:30 UTC it fails (and, via auto_cancel: on_job_failure, cancels) every pipeline, develop included. The Go vuln DB published 12 new reachable advisories:

• stdlib (fixed in go1.26.9): GO-2026-6599, 6600 (html/template), 6603, 6605, 6609, 6610, 6611, 6612, 6613, 6617 (net/http), 6607 (crypto/tls), 6608 (net/textproto, mime/multipart)
• golang.org/x/net/http2 (fixed in v0.60.0): GO-2026-6603, 6610, 6612, 6617

What

• Go toolchain 1.26.6 → 1.26.9 everywhere it is pinned (same file set as the last bump in 5c6c301d: go.mod, .go-version, CI default image + dependency-proxy probe, trunk runtime, Dockerfiles, README, test/simulation/go.mod).
• golang.org/x/net v0.58.0 → v0.60.0 in both modules. MVS also moves x/crypto 0.57, x/text 0.42, x/sys 0.48, x/term 0.46, x/sync 0.23, x/mod 0.41, x/tools 0.49.
• Drop GO-2026-4740 from .govulncheck-ignore (the script warned it is no longer reported).

scripts/govulncheck.sh locally: no reachable vulnerabilities outside the allowlist.

Also: go-tss flake

go-tss runs on this MR (go.mod changed) and failed on TestFrostKeygenEarlyResultQuorumSurvivesRound3 ("timeout waiting for frost dkg result"), the same failure seen on a develop-equivalent pipeline on 2026-10-08. The test gave WaitForResult a 20ms timeout for two already-queued results; on a loaded runner the timer races the second one. Widened to a 5s backstop (it returns at quorum, so no slowdown). Test-only.

Consensus safety

• x/text v0.41 → v0.42 is on the EIP-712 ante path (eip712.sanitizeTypedef → cases.Title(language.English, cases.NoLower)). v0.42 fixes NFC/NFKC composition (blocked starters, combining marks after Hangul, 21-bit recomposition keys). Differential test under go1.26.9 over every Unicode scalar + 3M random mark/starter/Hangul sequences (4.1M inputs): cases.Title and NFD/NFKD are byte-identical; NFC/NFKC differ on 12 adversarial sequences. Among the deps of ./app and ./x/thorchain/..., the only other NFC callers are afero NeuterAccents, sentry ratelimit and x/net idna, none of which touch state.
• x/crypto v0.55 → v0.57 changes only acme and ssh, neither linked into the app.
• The Go patch release does not change unicode tables or anything else on the state machine.

🤖 Generated with Claude Code