Raise the go directive to 1.26.9 once nixpkgs ships it #891

#886 fixed the security CI failures with `toolchain go1.26.9` and left `go 1.26.7`, because nixpkgs (master, nixos-unstable, nixpkgs-unstable) is still on Go 1.26.8 and a 1.26.9 floor would turn `Nix flake builds` red.

The `toolchain` line covers CI and release builds. It does not cover `go install github.com/basecamp/basecamp-cli/cmd/basecamp@latest` run with Go 1.26.7 or 1.26.8: those builds still link the standard library that govulncheck flagged (GO-2026-6599, 6600, 6603, 6605, 6607, 6608, 6610, 6611, 6612, 6613, 6617).

When nixpkgs ships Go 1.26.9: raise the `go` line to 1.26.9, drop the now-redundant `toolchain` line, update `flake.lock`, and recompute the vendorHash with `make update-nix-hash`.