govulncheck reports GO-2026-6809 (crypto/x509 distrusting compromised
intermediates) reachable from backup verification on Go 1.26.9; 1.26.10 fixes
it. go.mod drives the GitHub runners; the Gitea fallback image is re-pinned to
the 1.26-bookworm digest that ships 1.26.10.