chore: upgrade to Go 1.26 and modernize

[jakthom]

Upgrades the module to Go 1.26 and takes up the standard-library features the code predated. Two commits, separable for review.

1. chore: upgrade to Go 1.26 and modernize

go.mod, CI and the README move to 1.26.

I checked what 1.26 actually offers here by diffing the 1.25.12 and 1.26.5 source trees and reading the compiler's version gates, rather than working from memory. Two results worth recording:

• new(expr) is 1.26's only language change and has no site in this module. No pointer-helper generics exist, and the &cloned returns in event.go mutate the local first.
• errors.AsType does not apply — this module uses errors.Is exclusively and never errors.As.

So the reductions come from slices, maps, cmp and the min/max builtins, which the code had not yet adopted:

• slices/maps replace hand-rolled clone, contains, equal, sort and dedup loops
• slices.Sorted(maps.Keys(...)) replaces collect-then-sort for deterministic map iteration
• min/max replace clamp blocks; Duration.Abs replaces a manual negate
• sync.WaitGroup.Go, range-over-int and strings.SplitSeq in tests
• a generic asEvents helper collapses six copies of the same widen-to-interface loop in gesture and action
• ControlOf extracts the stick/trigger mapping it repeated four times across value and pointer cases

2. refactor: model the safety lifecycle as a state machine

Adopts github.com/open-ships/statemachine for safety.Guard's operator lifecycle — the one place in the repo with a genuine event-driven state machine.

Three booleans (armed, latched, estop) mutated by hand in five places become one field with three states, moved by five commands through a compiled transition table. Arm's two refusals — no bound controller, and a latched e-stop that only Reset may clear — are now Guards on table rows rather than conditionals inside the method.

Mapping the booleans onto a table showed latched was written in four places and read in none. It is removed.

Arm still reports ErrUnbound and its own emergency-stop error rather than the machine's refusal, so the package's public error contract is unchanged for callers comparing with ==.

Deliberately not changed

• omitempty on nested struct fields (event.go, recorder.go) are genuine no-ops that omitzero would fix, but they are hashed into the audit record chain and compat_test.go pins format versions 1–3. Changing them breaks verification of logs already on disk — that is a format-version bump, not a cleanup.
• append([]byte(nil), x...) in audit/recorder.go and merkle.go collapses empty to nil, which HMACKey depends on: it is tested with != nil to select the HMAC chain, and WithHMAC builds a non-nil empty key rejected later. slices.Clone preserves empty and would change chain selection.
• cloneEvent's type switch is the largest remaining block. Giving all nine event types a CloneEvent() method collapses it to ~6 lines, but value-receiver methods are in *T's method set, so pointer events would return as values — silently changing the dynamic type for external processors publishing *ButtonEvent. A generic helper preserves types but turns one itab-dispatched switch into a linear scan of nine closures, on a per-event per-subscriber dispatch path. The duplication is load-bearing.

Verification

Both commits build and pass independently. Full matrix on the final tree: darwin/linux/windows (plus linux-arm64), CGO_ENABLED 0 and 1, go vet per platform, gofmt, and -race. modernize reports nothing outside the omitempty items above.

Because the two behavior-sensitive rewrites had thin existing coverage, each was checked against a verbatim transcription of the code it replaced, then the check was deleted:

• the safety lifecycle, over every command sequence to depth six, bound and unbound, comparing Arm's error and both predicates Evaluate reads
• ControlOf, over all six arms including invalid IDs and nil

Note

stickControl/triggerControl now exist as identical unexported copies in teleop, gesture and action. Unifying them means exporting new public API, so I left the copies — happy to do it if wanted.