Update Go crypto dependencies and align the Go toolchain

[mswilkison]

Depends on #19 and is stacked on codex/deps-protobuf-runtime.

Upgrade golang.org/x/crypto to v0.52.0 and its required golang.org/x/sys to v0.45.0. These versions cover the 25 current x/crypto Dependabot alerts and the single x/sys alert, including the published June 2026 SSH fixes. The inherited protobuf update remains v1.33.0.

Raise the Go minimum to 1.25.7 and select Go 1.26.8 in the module and both CI workflows. This aligns with keep-core #4312; downstream adoption requires the Go upgrade. Modern module pruning makes existing indirect dependencies explicit without upgrading their versions. The selected x/sys version supersedes the older upgrade in #11/#17 and must be retained when those branches are integrated.

Validation on the final stacked commit with Go 1.26.8:

• Complete CKD, tss, and signing suites pass, including all 12 existing xpub derivation vectors, inherited binary protobuf compatibility tests, and ordinary/HD signing E2E tests.
• Full build, vet, module-tidy consistency, formatting, and diff checks pass.
• Selected dependencies are x/crypto v0.52.0, x/sys v0.45.0, and protobuf v1.33.0. Independent review also checked Linux dependency selection and module checksums.
• Before stacking, the remaining inexpensive crypto packages and nine keygen controls passed. Full repository CI subsequently passed at the current stacked head, including the keygen, MtA, Paillier, and prime-generation suites.

The library imports RIPEMD-160 from x/crypto. This removes advisory-affected dependency versions without claiming that the SSH vulnerabilities were reachable through tss-lib.

Full test CI and formatting CI passed at the current head a1dc49cecbe436d45e03cf4c6ebe2e5f042691e5. These workflows were dispatched explicitly because this stacked PR does not target master.