ci: bump to Go 1.26 and address PR review feedback

The autofix failure is fixed properly by moving to Go 1.26 instead of the
GOTOOLCHAIN workaround. The official golangci-lint v2.12.2 binary is built
with go1.26.2 and lints a Go 1.26 target fine (the earlier "not ready"
claim was from a locally go-installed binary compiled with Go 1.25), and
the Dockerfiles already use golang:1.26-alpine, so this also aligns the
module with the images.

- go.mod: go 1.25.0 -> 1.26.0, drop the toolchain pin (keeps the lint
  target at the go directive).
- Taskfile: revert modernize to plain modernize@latest; on Go 1.26 the
  GOTOOLCHAIN dance and its comments are unnecessary.
- ci.yml: pass the resolved Go version through an env var (GO_VERSION)
  instead of interpolating steps.setup-go.outputs.go-version directly into
  shell scripts (script-injection hygiene); grant the dependency-review job
  pull-requests: write so it can post its summary.
- parser.go: derive defaultBaseURL from riseHost instead of duplicating the
  host string; drop the redundant per-const comments.
- .golangci.yml: remove the redundant go-version comment.
- regenerate internal/exporters/output.docx.

internal/services/parser.go

@@ -17,10 +17,8 @@ import (
 
 // Default endpoint configuration for the Articulate Rise API.
 const (
-	// Root URL for the Articulate Rise API.
-	defaultBaseURL = "https://rise.articulate.com"
-	// Expected host for Articulate Rise share URLs.
-	riseHost = "rise.articulate.com"
+	riseHost       = "rise.articulate.com"
+	defaultBaseURL = "https://" + riseHost
 )
 
 // shareIDRegex is compiled once at package init for extracting share IDs from URIs.