The Nix-built binary stayed on go 1.26.5 because the locked nixpkgs
shipped it and its Go builder pins GOTOOLCHAIN=local. nixos-26.05 now
ships go 1.26.7 (pkgs/development/compilers/go/1.26.nix at 1bc55b9d),
so the 8 stdlib advisories accepted for that lag are removed. The one
entry left, GO-2026-5932, is a deprecation advisory on x/crypto/openpgp
that can never clear: pad requires the module for bcrypt and does not
import openpgp. Its reason is corrected to say so.
Claude-Session: https://claude.ai/code/session_01RYiqbqXmxQMoKHsGm8B77N
Adds a Nix flake exposing the pad binary as packages.default (buildGoModule
+ importNpmLock for the embedded SvelteKit UI), a devShell, and flake
checks (package build with `go test ./...`, plus a `pad --version` smoke
test). nix/package.nix is written nixpkgs-submission-ready (no
flake-specific inputs) so it can later be adapted for pkgs/by-name.
Also adds a GitHub Actions workflow that runs `nix flake check` and
`nix build` on push/PR, and documents `nix run` / `nix profile install`
/ `nix develop` in the README.
xarmian