Raise the API module to go1.26.2 so setup-go stops selecting a vulnerable standard library release, and add a regression test that fails on affected 1.26.x toolchains. Closes #14