fix(#129): align GHA maintenance and stop dependabot dropping updates.

[fgm]

Dependabot ran on the default open-pull-requests-limit of 5 against 8 actions, and unmerged PRs keep holding that quota, so lower-ranked updates were never proposed: six of the eight months to 2026-08 produced none at all. Grouping makes the limit unreachable.

In the same area:

• The three scheduled workflows used "1-7 * " crons. Cron ORs day-of-month with day-of-week, so Update fired ten times in August rather than once. The day-of-month test moves into a shared check-first-week.yml, named for the week rather than for Saturday so scorecard's Thursday schedule can share it.
• setup-go took a hardcoded 1.24 in three places and now reads go.mod. update.yml ran setup-go before checkout, which go-version-file cannot support, so those two steps are swapped.
• go.mod moves to 1.26.7: lowest supported minor, at its latest patch.
• The six actions dependabot never reached are bumped to latest, matching the SHAs fgm/envrun already runs.
• The Go Report Card badge is dropped; the service shut down.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.22%. Comparing base (ac2cece) to head (158e916).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #131   +/-   ##
=======================================
  Coverage   98.22%   98.22%           
=======================================
  Files          15       15           
  Lines         451      451           
=======================================
  Hits          443      443           
  Misses          6        6           
  Partials        2        2           

Flag	Coverage Δ
unittests	98.22% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.