chore: modernize CI and update Go toolchain

- Bump Go from 1.19 to 1.26 and update all dependencies
- Rewrite CI workflow with matrix strategy (Linux, macOS, Windows)
- Update GitHub Actions to current versions (checkout@v4, setup-go@v5)
- Update CodeQL actions from v1 to v3
- Fix cross-platform bug in mock/path.go (path.Join -> filepath.Join)
- Clean up dependabot config (weekly schedule, remove stale ignore)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vendor/github.com/go-git/go-billy/v5/osfs/os_bound.go

@@ -176,6 +176,14 @@ func (fs *BoundOS) Readlink(link string) (string, error) {
 	return os.Readlink(link)
 }
 
+func (fs *BoundOS) Chmod(path string, mode os.FileMode) error {
+	abspath, err := fs.abs(path)
+	if err != nil {
+		return err
+	}
+	return os.Chmod(abspath, mode)
+}
+
 // Chroot returns a new OS filesystem, with the base dir set to the
 // result of joining the provided path with the underlying base dir.
 func (fs *BoundOS) Chroot(path string) (billy.Filesystem, error) {
@@ -246,6 +254,10 @@ func (fs *BoundOS) insideBaseDir(filename string) (bool, error) {
 // a dir that is within the fs.baseDir, by first evaluating any symlinks
 // that either filename or fs.baseDir may contain.
 func (fs *BoundOS) insideBaseDirEval(filename string) (bool, error) {
+	// "/" contains all others.
+	if fs.baseDir == "/" {
+		return true, nil
+	}
 	dir, err := filepath.EvalSymlinks(filepath.Dir(filename))
 	if dir == "" || os.IsNotExist(err) {
 		dir = filepath.Dir(filename)
@@ -255,7 +267,7 @@ func (fs *BoundOS) insideBaseDirEval(filename string) (bool, error) {
 		wd = fs.baseDir
 	}
 	if filename != wd && dir != wd && !strings.HasPrefix(dir, wd+string(filepath.Separator)) {
-		return false, fmt.Errorf("path outside base dir")
+		return false, fmt.Errorf("%q: path outside base dir %q: %w", filename, fs.baseDir, os.ErrNotExist)
 	}
 	return true, nil
 }

vendor/github.com/go-git/go-billy/v5/osfs/os_chroot.go

@@ -74,6 +74,10 @@ func (fs *ChrootOS) Remove(filename string) error {
 	return os.Remove(filename)
 }
 
+func (fs *ChrootOS) Chmod(path string, mode os.FileMode) error {
+	return os.Chmod(path, mode)
+}
+
 func (fs *ChrootOS) TempFile(dir, prefix string) (billy.File, error) {
 	if err := fs.createDir(dir + string(os.PathSeparator)); err != nil {
 		return nil, err

vendor/github.com/go-git/go-billy/v5/osfs/os_posix.go

@@ -1,5 +1,5 @@
-//go:build !plan9 && !windows && !js
-// +build !plan9,!windows,!js
+//go:build !plan9 && !windows && !wasm
+// +build !plan9,!windows,!wasm
 
 package osfs
 

vendor/github.com/go-git/go-billy/v5/osfs/os_wasip1.go

@@ -0,0 +1,34 @@
+//go:build wasip1
+// +build wasip1
+
+package osfs
+
+import (
+	"os"
+	"syscall"
+)
+
+func (f *file) Lock() error {
+	f.m.Lock()
+	defer f.m.Unlock()
+	return nil
+}
+
+func (f *file) Unlock() error {
+	f.m.Lock()
+	defer f.m.Unlock()
+	return nil
+}
+
+func rename(from, to string) error {
+	return os.Rename(from, to)
+}
+
+// umask sets umask to a new value, and returns a func which allows the
+// caller to reset it back to what it was originally.
+func umask(new int) func() {
+	old := syscall.Umask(new)
+	return func() {
+		syscall.Umask(old)
+	}
+}