build(deps): go1.26.9 and golang.org/x/net v0.60.0

Close stdlib (net/http, crypto/tls, mime/multipart, net/http/httputil)
and x/net advisories published after the go1.26.8 release
(GO-2026-6603..6617, CVE-2026-78667/78669/97031).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/package/Dockerfile

@@ -1,8 +1,8 @@
 # Build context is the repo root: docker build -f build/package/Dockerfile .
 # Go patch release pinned (not the floating 1.26 tag) so the shipped standard
-# library is reproducible and includes the security fixes up to go1.26.8;
+# library is reproducible and includes the security fixes up to go1.26.9;
 # keep in step with the `toolchain` line in go.mod.
-FROM golang:1.26.8-alpine3.24 AS builder
+FROM golang:1.26.9-alpine3.24 AS builder
 
 # godal (GDAL bindings) needs cgo, a C/C++ toolchain and the GDAL headers.
 # g++ is required: parts of the binding compile as C++ against GDAL's headers.
@@ -17,7 +17,7 @@ COPY . .
 RUN CGO_ENABLED=1 GOOS=linux go build -trimpath -o /out/gis ./cmd/gis
 
 # Must stay on the same Alpine release as the builder — hence the pinned
-# `golang:1.26.8-alpine3.24` above rather than the floating `-alpine` tag. A
+# `golang:1.26.9-alpine3.24` above rather than the floating `-alpine` tag. A
 # mismatch ships a different libgdal soname, and the image still builds green
 # while the binary dies at startup with "libgdal.so.NN: No such file".
 # Bump both lines together.