Maintenance update for Bootrecov v0.4.16:

- Refresh Bubble Tea, Bubbles, Lip Gloss and supporting Go dependencies.
- Require Go 1.26.10 or newer when building from source.
- Enable Dependabot and reachable-vulnerability checks; pin GitHub Actions to reviewed commit identities.

Recovery commands, package-hook behavior and platform support are unchanged. Existing BusyBox mkinitcpio/dracut limitations and explicit risk acknowledgement continue to apply.

Validated with `make test` and the required real Ubuntu/GRUB recovery-boot gate in a disposable QEMU guest, including a second recovery boot after primary-kernel corruption. The initial TCG guest bootstrap needed a serial boot continuation after slow device discovery; the recovery reboots completed without intervention. Release binaries and the AUR source archive have independently verified checksums.