all: upgrade to Go 1.26rc2 and modernize codebase

This commit upgrades the codebase from Go 1.25.5 to Go 1.26rc2 and
adopts new language features.

Toolchain updates:
- go.mod: go 1.25.5 → go 1.26rc2
- flake.nix: buildGo125Module → buildGo126Module, go_1_25 → go_1_26
- flake.nix: build golangci-lint from source with Go 1.26
- Dockerfile.integration: golang:1.25-trixie → golang:1.26rc2-trixie
- Dockerfile.tailscale-HEAD: golang:1.25-alpine → golang:1.26rc2-alpine
- Dockerfile.derper: golang:alpine → golang:1.26rc2-alpine
- .goreleaser.yml: go mod tidy -compat=1.25 → -compat=1.26
- cmd/hi/run.go: fallback Go version 1.25 → 1.26rc2
- .pre-commit-config.yaml: simplify golangci-lint hook entry

Code modernization using Go 1.26 features:
- Replace tsaddr.SortPrefixes with slices.SortFunc + netip.Prefix.Compare
- Replace ptr.To(x) with new(x) syntax
- Replace errors.As with errors.AsType[T]

Lint rule updates:
- Add forbidigo rules to prevent regression to old patterns

integration/ssh_test.go

@@ -13,7 +13,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"tailscale.com/tailcfg"
-	"tailscale.com/types/ptr"
 )
 
 func isSSHNoAccessStdError(stderr string) bool {
@@ -85,8 +84,8 @@ func TestSSHOneUserToAll(t *testing.T) {
 					// Use autogroup:member and autogroup:tagged instead of wildcard
 					// since wildcard (*) is no longer supported for SSH destinations
 					Destinations: policyv2.SSHDstAliases{
-						ptr.To(policyv2.AutoGroupMember),
-						ptr.To(policyv2.AutoGroupTagged),
+						new(policyv2.AutoGroupMember),
+						new(policyv2.AutoGroupTagged),
 					},
 					Users: []policyv2.SSHUser{policyv2.SSHUser("ssh-it-user")},
 				},
@@ -160,7 +159,7 @@ func TestSSHMultipleUsersAllToAll(t *testing.T) {
 					// Username destinations (e.g., "user1@") now require the source
 					// to be that exact same user only. For group-to-group SSH access,
 					// use autogroup:self instead.
-					Destinations: policyv2.SSHDstAliases{ptr.To(policyv2.AutoGroupSelf)},
+					Destinations: policyv2.SSHDstAliases{new(policyv2.AutoGroupSelf)},
 					Users:        []policyv2.SSHUser{policyv2.SSHUser("ssh-it-user")},
 				},
 			},
@@ -285,7 +284,7 @@ func TestSSHIsBlockedInACL(t *testing.T) {
 				{
 					Action:       "accept",
 					Sources:      policyv2.SSHSrcAliases{groupp("group:integration-test")},
-					Destinations: policyv2.SSHDstAliases{ptr.To(policyv2.AutoGroupSelf)},
+					Destinations: policyv2.SSHDstAliases{new(policyv2.AutoGroupSelf)},
 					Users:        []policyv2.SSHUser{policyv2.SSHUser("ssh-it-user")},
 				},
 			},
@@ -340,13 +339,13 @@ func TestSSHUserOnlyIsolation(t *testing.T) {
 				{
 					Action:       "accept",
 					Sources:      policyv2.SSHSrcAliases{groupp("group:ssh1")},
-					Destinations: policyv2.SSHDstAliases{ptr.To(policyv2.AutoGroupSelf)},
+					Destinations: policyv2.SSHDstAliases{new(policyv2.AutoGroupSelf)},
 					Users:        []policyv2.SSHUser{policyv2.SSHUser("ssh-it-user")},
 				},
 				{
 					Action:       "accept",
 					Sources:      policyv2.SSHSrcAliases{groupp("group:ssh2")},
-					Destinations: policyv2.SSHDstAliases{ptr.To(policyv2.AutoGroupSelf)},
+					Destinations: policyv2.SSHDstAliases{new(policyv2.AutoGroupSelf)},
 					Users:        []policyv2.SSHUser{policyv2.SSHUser("ssh-it-user")},
 				},
 			},
@@ -522,10 +521,10 @@ func TestSSHAutogroupSelf(t *testing.T) {
 				{
 					Action: "accept",
 					Sources: policyv2.SSHSrcAliases{
-						ptr.To(policyv2.AutoGroupMember),
+						new(policyv2.AutoGroupMember),
 					},
 					Destinations: policyv2.SSHDstAliases{
-						ptr.To(policyv2.AutoGroupSelf),
+						new(policyv2.AutoGroupSelf),
 					},
 					Users: []policyv2.SSHUser{policyv2.SSHUser("ssh-it-user")},
 				},