[dependabot]

Summary

• Update native upstream quic-go to v0.63.0 and golang.org/x/net to v0.59.0, with their required x/crypto, x/sys, and x/text updates.
• Raise the minimum supported toolchain to Go 1.26.8 and align Linux, macOS, Windows, vulnerability-check CI, and README prerequisites. The existing Go 1.27 test lane remains.
• Regenerate third-party notices and refresh current-build dependency metadata in documentation and the offline pilot config generator.
• Correct the real TLS H1/H2 request-trailer test fixture for Go 1.26 request-body ownership: observe actual outbound transport closure with a bounded wait, preserve trailer-map identity, and separately clean up the fixture-owned inbound body. No production proxy implementation changes.

Validation

• Go 1.26.8: make check passed, including all Go packages, vet, module/license checks, and 51 release-recipe/artifact/smoke tests.
• Go 1.27.1: full make race passed.
• Request-trailer targeted race tests passed on both Go 1.26.8 and 1.27.1, including verified TLS H1/H2 exchanges.
• python3 scripts/stealth-pilot-config.py self-test and git diff --check passed.
• Go 1.26.8 scripts/govulncheck.sh passed: no called-code or imported-package vulnerabilities; two module-only findings whose vulnerable symbols are not called.
• Independent static review found no blocking issues. GitHub checks for the pushed head must pass before merging.

Docker deployment changes and large-scale comparative traffic collection are outside this PR.