chore: refresh release toolchain

[steipete]

Summary

• move CI, Pages, release, and container builds to Node 26 and pnpm 11.13.1
• update checkout, setup-node, setup-go, and AWS credential actions to their latest stable releases with immutable SHAs
• update GoReleaser to 2.17.0 and refresh pinned Node/Alpine container digests

Proof

• npx --yes pnpm@11.13.1 check — passed
• npx --yes pnpm@11.13.1 coverage — passed, 85.4% total
• npx --yes pnpm@11.13.1 test:e2e — passed, 98/98
• npx --yes pnpm@11.13.1 outdated -r --format json — no outdated workspace dependencies
• npx --yes pnpm@11.13.1 audit --audit-level=high — no known vulnerabilities
• go run golang.org/x/vuln/cmd/govulncheck@latest ./... — no vulnerabilities
• go run github.com/rhysd/actionlint/cmd/actionlint@latest — passed
• goreleaser check — passed
• snapshot GoReleaser build — passed for eight cross-platform archives plus DEB/RPM and checksums
• production and Cloudflare Dockerfiles — both built successfully with Node 26 and pnpm 11.13.1
• AutoReview branch mode against origin/main — clean, no actionable findings