ci: bump Go, golangci-lint, codespell, and runners

[kolyshkin]

• Test matrix: stable, oldstable and a version from go.mod.
• Validate jobs: simplify to just use stable.
• golangci-lint: v2.4 -> v2.12.
• codespell: 2.4.1 -> 2.4.3.
• Runners: ubuntu-24.04 -> ubuntu-26.04.

The actions themselves are already kept current by dependabot.

[kolyshkin]

CI bumps; easy to review; PTAL @opencontainers/cgroups-maintainers

[AkihiroSuda]

Can we just test oldstable and stable

[kolyshkin]

Can we just test oldstable and stable

@AkihiroSuda we also have to specify the version from go.mod, and in case this version is accidentally the same as "oldstable" or "stable", we have the test running twice on the same Go version.

If we use numbers, we can clearly see if there's redundancy here.

What do you think?

[kolyshkin]

Can we just test oldstable and stable

@AkihiroSuda we also have to specify the version from go.mod, and in case this version is accidentally the same as "oldstable" or "stable", we have the test running twice on the same Go version.

If we use numbers, we can clearly see if there's redundancy here.

What do you think?

More arguments towards keeping the versions explicit (as opposed to using stable/oldstable and derive Go version from go.mod) are in #15.

[thaJeztah]

Yeah, pros and cons to each; for some repositories, I'm using go.mod itself as "minimum", and "oldstable", "stable" for the upper-bound, but that's usually for repositories that don't get frequent updates. If we want to use fixed versions, we could consider adding tip to get an early warning for things that may break in the near future.

Here's what I did on some of those repositories;

• ci: use go.mod for "minimum" Go version, and use custom name moby/go-archive#29

Even if we decide not to use oldstable, stable, using the custom names could still be useful to get stable names in the CI tasks (although we handled it here with the "all-done" I think?)

[kolyshkin]

OK I've reverted to using oldstable, stable and go-version-file: go.mod. This means we won't have to update versions used for CI, but also that CI is slightly more prone to breakage (but I'm fine with it).

PTAL @thaJeztah

[thaJeztah]

LGTM