go.mod requires >=1.26.1 but the Dockerfile pinned golang:1.25 -> 'go.mod requires go >= 1.26.1 (running go 1.25.11)'. Also revert the ci.yml XDG hack: the real rootless-buildah fix is a user ~/.config/containers/storage.conf (vfs + writable runroot), which fixes plain buildah for every repo without workflow changes.