[sjmiller609]

Summary

• Build the server, image-generation helper and release images with Go 1.26.10, which includes the CVE-2026-111943 certificate-chain mitigation.
• Pull fresh base images and bypass release-layer caches.

Validation

• Passed all server tests and built the Linux server using Go 1.26.10.
• Verified the built server's Go version.
• Full multi-architecture container builds and live-view end-to-end tests were not run.

Release order

After merging, publish v3.0.8-v1.6.3 so browser-image consumers can move from 3.0.8-v1.6.2. This PR does not publish a release or change running services.

---

Note

Low Risk
Toolchain and Docker build-flag updates only; no application logic changes, though CI base builds will be slower and less cache-dependent until images are republished.

Overview
Bumps the server build to Go 1.26.10 across server/go.mod, server Dockerfiles, and the local build script so compiled images pick up the Go runtime fix for CVE-2026-111943 (certificate-chain handling).

The base-image CI workflow now passes pull: true and no-cache: true to docker/build-push-action, forcing fresh base layers on release builds despite still declaring GHA cache import/export. The build helper’s Dockerfile generator container moves from golang:1.24-bullseye to golang:1.26.10-bookworm, aligning with the bookworm server image path.

^{Reviewed by Cursor Bugbot for commit 08c0dab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chruffins]

Reviewed; no findings.