[v0.20.x-branch] Backport #11098: build: bump Go language to 1.25.13 and toolchain to 1.26.6

[ziggie1984]

Backport of #11098

Opened manually rather than via the backport bot, since the change touches
.github/ files.

---

• all tracked go.mod files move to go 1.25.13
• release/toolchain pins move to Go 1.26.6 across Makefile, CI, Dockerfiles, golangci-lint config, and protobuf generation
• install docs reference Go 1.25.13 with the official Linux amd64 and ARMv6 SHA256 checksums

Behaviour change reviewers should be aware of

Unlike the v0.21.x backport (#11101), this branch was on go 1.24.11, so the
go directive crosses a Go minor. That directive is what selects the GODEBUG
compatibility baseline compiled into the binary, so five defaults flip. Verified
on the built binary:

before (go 1.24.11):
  DefaultGODEBUG=containermaxprocs=0,cryptocustomrand=1,decoratemappings=0,
                 tlssecpmlkem=0,tlssha1=1,updatemaxprocs=0,urlstrictcolons=0,
                 x509sha256skid=0

after  (go 1.25.13):
  DefaultGODEBUG=cryptocustomrand=1,tlssecpmlkem=0,urlstrictcolons=0

What each dropped pin means for lnd:

Setting	Effect	Assessment
containermaxprocs, updatemaxprocs	GOMAXPROCS now derives from cgroup CPU limits, and tracks changes to them	The only operationally visible change. lnd never calls runtime.GOMAXPROCS; the five runtime.NumCPU() call sites (rpcserver.go, autopilot/top_centrality.go, fn/slice.go, sig pools) are unaffected, since NumCPU reads the affinity mask rather than the cgroup quota. Containerised nodes may see a different scheduler P count.
x509sha256skid	Newly generated certs get a SHA-256 derived Subject Key ID	cert/selfsigned.go omits SubjectKeyId with IsCA: true, so Go computes it. Cosmetic: the cert is self-signed and pinned by clients. Certs already on disk are untouched.
tlssha1	SHA-1 signature algorithms rejected in TLS 1.2	Inert. cert/tls.go already pins four non-SHA-1 suites with MinVersion: TLS1.2.
decoratemappings	VMA naming on Linux	Observability only.

All five remain overridable at runtime via the GODEBUG environment variable,
so an operator can restore the previous behaviour without a rebuild.

Additional fix: windows-arm -> windows-arm64 release target

Go 1.26 drops the 32-bit windows/arm port, so cross-compiling the windows-arm
release target fails once the toolchain moves to 1.26.6. The release matrix in
.github/workflows/main.yml and the target list in make/release_flags.mk are
switched to windows-arm64.

This mirrors master's #10838 (commit d3dad1690), which bundled the same arm64
switch into an earlier Go toolchain bump. That change was never backported to
v0.20.x, so it is carried here alongside the toolchain bump that requires it.
Added as its own commit for clarity.

Backport adaptations

Every hunk conflicted, since the branch was on go 1.24.11 / toolchain
1.25.5. Conflicts were resolved by taking the incoming version numbers; four
places needed manual attention:

• Three files do not exist on this branch and are deliberately not
  introduced: .github/workflows/govulncheck.yml, actor/go.mod, and
  sqldb/v2/go.mod.

• queue/go.mod — this branch keeps its go directive at the end of the
  file, while master has it at the top. The three-way merge produced a file with
  two go directives and dropped the require github.com/lightningnetwork/lnd/ticker
  line. Rewritten so the only change is the version.

• kvdb/go.mod — the go directive sits after two replace directives
  (GHSA-25xm-hr59-7c27 and GO-2021-0053) that master no longer has in that
  position. The conflict region spanned them; restored explicitly.

• mobile/README.md — this branch still referenced go1.17.6 via the old
  golang.org/dl URL. Master fixed that in an earlier bump that was never
  backported, so the line is brought up to date here rather than left stale.

Testing

• make check-go-version — all Dockerfiles and YAML files report 1.26.6
• GOTOOLCHAIN=go1.26.6 make build — lnd-debug and lncli-debug build and report 0.20.3-beta
• GOTOOLCHAIN=go1.26.6 go build ./... in all 11 submodules — clean
• go mod edit -json parses all 13 tracked go.mod files; each verified to contain exactly one go directive and to differ from the branch only in the version line
• git diff --check — clean
• no remaining 1.24.11 or 1.25.5 references in tracked files

[github-actions]

🔴 PR Severity: CRITICAL

file classification | 27 files | 78 lines changed

🔴 Critical (1 file)

• sqldb/go.mod - under sqldb/*, which is always classified CRITICAL per the database-migration rule, even though this particular change is only a Go toolchain version bump

🟠 High (3 files)

• cert/go.mod - under cert/* (auth/security-adjacent package)
• lnrpc/Dockerfile - under lnrpc/* (RPC/API package)
• lnrpc/gen_protos_docker.sh - under lnrpc/* (RPC/API package)

🟡 Medium (9 files)

• go.mod - root module, uncategorized Go dependency file
• fn/go.mod - under fn/*
• tlv/go.mod - under tlv/*
• tor/go.mod - under tor/*
• kvdb/go.mod - under kvdb/*
• queue/go.mod - uncategorized Go dependency file
• ticker/go.mod - uncategorized Go dependency file
• healthcheck/go.mod - uncategorized Go dependency file
• clock/go.mod - uncategorized Go dependency file

🟢 Low (14 files)

• .github/actions/setup-go/action.yml - CI configuration
• .github/workflows/main.yml - CI configuration
• .github/workflows/release.yaml - CI configuration
• .golangci.yml - lint tooling configuration
• Dockerfile - build/docker configuration
• Makefile - build configuration
• dev.Dockerfile - build/docker configuration
• docker/btcd/Dockerfile - build/docker configuration
• docs/INSTALL.md - documentation
• make/builder.Dockerfile - build configuration
• mobile/README.md - documentation
• tools/Dockerfile - build/docker configuration
• tools/go.mod - tooling dependency
• tools/linters/go.mod - tooling dependency

Analysis

This PR is a mechanical Go toolchain/version bump (go 1.25.13 → 1.26.6) touching go.mod files, Dockerfiles, CI workflows, the Makefile, and docs across the repo — no application logic changes. It lands at CRITICAL for two reasons: (1) sqldb/go.mod falls under sqldb/*, which the always-CRITICAL database-migration rule applies to regardless of the actual content of the change, and (2) the PR touches 27 non-test files, exceeding the 20-file bump-up threshold. Despite the label, an expert reviewer should find this low-risk to actually review — it's purely a build/toolchain version update, not a functional or schema change.

---

_{To override, add a severity-override-{critical,high,medium,low} label.}

[ziggie1984]

Heads up for reviewers: pushed one additional commit — a14492936 (build: replace windows-arm release target with windows-arm64).

Go 1.26 drops the 32-bit windows/arm port, so once this PR moves the toolchain to 1.26.6 the windows-arm release target fails to cross-compile. Master handled this in #10838 (commit d3dad1690), which folded the arm64 switch into an earlier Go toolchain bump, but that was never backported to v0.20.x — so it's carried here alongside the toolchain bump that requires it.

It's a two-line change (.github/workflows/main.yml release matrix + make/release_flags.mk), byte-identical to what master did, kept as its own commit for clarity. PR description updated with the details.