v2.35.1 (#829)

## Summary
Rebuild dbmate with Go 1.26.6 to address CVE-2026-39821 (GO-2026-5026).

## Changes
- Bump `toolchain` in go.mod to go1.26.6
- Bump dev Dockerfile base image to golang:1.26.6
- Version bump to 2.35.1

## Test plan
- [ ] CI passes
- [ ] Tag `v2.35.1` after merge to publish npm + Docker images
- [ ] Foxglove `app` PR bumps to dbmate@2.35.1 (blocked on this release)


Made with [Cursor](https://cursor.com)

Co-authored-by: Cursor <cursoragent@cursor.com>