fix(docker): bump build image to golang:1.26 to match go.mod 1.26.1

go.mod requires >=1.26.1 but the Dockerfile pinned golang:1.25 -> 'go.mod
requires go >= 1.26.1 (running go 1.25.11)'. Also revert the ci.yml XDG hack:
the real rootless-buildah fix is a user ~/.config/containers/storage.conf (vfs +
writable runroot), which fixes plain buildah for every repo without workflow
changes.

Dockerfile

@@ -3,7 +3,7 @@
 # ── build ───────────────────────────────────────────────────────────────────
 # templ output (*_templ.go) and the vendored htmx asset are committed, so a
 # plain `go build` produces a self-contained binary — no codegen, no CDN.
-FROM golang:1.25 AS build
+FROM golang:1.26 AS build
 
 WORKDIR /src