Use cached Go 1.26.6 from nixpkgs - #304

Why

A fresh Nix store currently recompiles Go 1.26.6 because the locked nixpkgs-unstable snapshot only provides 1.26.5. That makes the cold diagnostic path much more expensive than it needs to be.

The latest unstable snapshot still has 1.26.5, and the staging commit that introduced 1.26.6 is not substitutable. This pins the immutable Aug 22 NixOS 26.05 snapshot (a9e6d84f9c2f9012f5fe7d964a7851352300e61a), where go_1_26 is exactly 1.26.6 and cached on both supported Linux architectures. The original input remains nixpkgs-unstable; once unstable catches up, a normal lock update can return there.

What changed

• regenerate flake.lock with Nix at the cached 1.26.6 snapshot
• select go_1_26 directly for both the package and development shell
• remove the upstream Go source override
• update Nix maintenance guidance and mark the non-vendor source-hash fixtures as historical

Verification

• fresh disposable aarch64-Linux Nix store: 71.34s, full flake build passed
• exact evaluation: go_1_26.version == 1.26.6
• build plan scheduled only hey-0.2.2-go-modules.drv and hey-0.2.2.drv; Nix fetched /nix/store/...-go-1.26.6 from cache.nixos.org
• x86_64-Linux dry-run likewise fetched Go 1.26.6 and scheduled no Go derivation
• built binary: hey version 0.2.2
• all-system nix flake check --no-build: passed
• focused Bats: 38/38
• bash -n, ShellCheck, release lockstep, and git diff --check: passed
• independent xhigh Codex review: no actionable findings

Stack order

This is an independently mergeable foundation against main. It should land before the Go 1.27 stack (#283 → #296); no history in that existing stack is rewritten by this PR.

Summary by cubic

Use cached Go 1.26.6 from nixpkgs to avoid rebuilding the toolchain on fresh Nix stores. Previously we rebuilt 1.26.6 from source because nixpkgs-unstable had 1.26.5; now flake.lock pins an Aug 22 NixOS 26.05 snapshot where go_1_26 is 1.26.6 and substitutable.

• Pin flake.lock to the snapshot with cached go_1_26 == 1.26.6 on x86_64-linux and aarch64-linux.
• Use go_1_26 directly for the package and nix develop; remove the source-tarball override in nix/go.nix.
• Update RELEASING.md to: when go.mod advances past the lock, run nix flake update nixpkgs and commit flake.lock.
• Keep vendor-hash extraction scoped to go-modules; update comments/tests and mark non-vendor fixtures as historical.
• Impact: cold builds fetch the toolchain, schedule no Go derivation, and complete faster.
• Order: merge before the Go 1.27 stack.

^{Written for commit df0fdc8. Summary will update on new commits.}