govulncheck: findings on the default branch

The scheduled `govulncheck` run **could not complete**. This is a scanner or environment failure, not a vulnerability report.

Commit: `005ce0c07790034bd05f357e660baf77d06ba21f`
Run: https://github.com/basecamp/once/actions/runs/33479214741

govulncheck output

```
===== linux/amd64 .
No vulnerabilities found.
===== linux/arm64 .
No vulnerabilities found.
===== darwin/amd64 .
No vulnerabilities found.
===== darwin/arm64 .
No vulnerabilities found.
===== installer
module declares go1.26.7 but the scan is running go1.27.0; align the go directives or give this module its own scan job.
```

Standard library findings are usually cleared by bumping the `go` directive in `go.mod` (and any `FROM golang:` base image) to the version named under "Fixed in".

An entry marked "accepted, but now fixed" means an ID in this workflow's ACCEPTED list has gained a fix for a module path we import: upgrade and drop the ID, rather than re-accepting it.

Start with go.mod and the scheduled govulncheck workflow, then inspect the installer scan and any FROM golang: base image. Reproduce the reported mismatch from the linked Actions run and determine whether the Go directives should be aligned or the installer needs its own scan job; done means the scheduled scan completes successfully without this failure.

Written by the indexing model from the issue text.