.github/workflows: Use supported Blacksmith runners

[euforic]

Summary

• move supported macOS 15/26 or remaining Ubuntu jobs to documented Blacksmith runners
• retain macOS 14, Intel macOS, and explicit self-hosted jobs because Blacksmith does not offer equivalent runner images
• preserve workflow behavior other than runner selection

Evidence

• Blacksmith runner catalog: https://docs.blacksmith.sh/blacksmith-runners/overview
• git diff --check
• actionlint with repository custom labels configured where required

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Note

Low Risk
CI and documentation-only runner migration plus a patch Go toolchain version bump; no application or security logic changes.

Overview
Moves macOS GitHub Actions jobs from GitHub-hosted macos-15 to the blacksmith-6vcpu-macos-latest runner label across CI (test, lint, govulncheck, actionlint, GoReleaser check), release (validate, publish), and the manual privileged macOS integration workflow.

Registers that label in .github/actionlint.yaml so workflow linting accepts the custom runner. Updates docs/pki-service.md to describe the privileged integration job as running on a fresh Blacksmith Apple Silicon macOS runner instead of GitHub-hosted macOS.

Bumps the module go directive in go.mod from 1.26.5 to 1.26.6; workflow steps and commands are otherwise unchanged.

^{Reviewed by Cursor Bugbot for commit 221cc1e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_12e6bc18-b352-4904-ad53-850659b9d320)

[cursor]

Stale comment

Not approved: Cursor Bugbot was present but skipped after hitting a usage/spend limit, so the required automated review did not complete successfully. Human review is needed; no reviewers were assigned because the only repository collaborator is the PR author.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: acbc3f2938

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3b029dd9-2789-4c8a-b818-c9f71281a4ad)

[cursor]

Stale comment

Not approved: Cursor Bugbot was present but skipped after a usage/spend limit, so the required automated review did not complete successfully. Human review is needed; no reviewers were assigned because the only repository collaborator is the PR author.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3e82180d-5074-41a0-9c02-0ae14266bda4)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ebbbba72-f65f-4d44-b864-00f59d9b51a0)

[cursor]

Not approved: Cursor Bugbot was present but skipped after a usage/spend limit, so the required automated review did not complete successfully. Human review is needed; no reviewers were assigned because the only repository collaborator is the PR author.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}