GeezerVison

Bump the bundled Terraform binary from 1.15.5
1.1.0
1.15.9 to 1.16.5 to match main (#30516).

Bump the bundled Terraform binary from 1.14.5 to 1.16.5 to match main (#30516).

Bump the bundled Terraform binary from 1.14.5 to 1.16.5 to match main (#30516).

Bump the bundled Terraform binary from 1.14.5 to 1.16.5 to match main (#30516).

Backport of #30807 to `release/2.38`.

Bumps the Go toolchain from 1.26.5 to 1.26.9. Tracked in Linear:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29)
(Iron Bank fix-by date 2026-10-29 for the Critical finding). Same
approach as the Terraform 1.16.5 backports (#30516 and its backports).

Files changed: `go.mod`, `mise.toml`, `mise.lock` (toolchain pin plus
the per-platform archive URLs and SHA-256 checksums from the official
`go.dev/dl` list).

Verified: `go build ./enterprise/cmd/coder` with go1.26.9 succeeds.
`govulncheck -mode binary` on the result no longer reports GO-2026-5026,
-5942, -6088, -6089, -6090, -6091, -6218, -6599, -6600, -6605, -6607,
-6608, -6609 or -6613.

**Companion PR:** the module side of GO-2026-6612 (Critical), -6603,
-6610, -6611 and -6617 is fixed by `golang.org/x/net` v0.60.0,
backported in #30814
([ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)).
This PR alone does not clear them; both are needed.

Opened by Superblink on behalf of @droopy4096.

Backport of #30516 to `release/2.38`.

Bumps the bundled Terraform binary from 1.16.2 to 1.16.6 (latest stable,
[released
2026-10-14](https://github.com/hashicorp/terraform/releases/tag/v1.16.6))
across `provisioner/terraform/install.go`, `install.sh`,
`scripts/Dockerfile.base`, `mise.toml`, `mise.lock`, `flake.nix`, and
the air-gap install example. Patch bump, so `maxTerraformVersion` stays
at 1.16.9. Checksums/SRI hashes come from HashiCorp's
`terraform_1.16.6_SHA256SUMS`.

Verified with `go test ./provisioner/terraform/...` on this branch.

Opened by Superblink on behalf of @droopy4096.

_Updated from 1.16.5 to 1.16.6 (adds an HTTP/2 resource-exhaustion fix).
Branch name still says 1.16.5. Fixture fingerprint (`generation.sha1`)
regenerated; tests not re-run locally, relying on CI._

---------

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Makovey <[email protected]>

Backport of #30516 to `release/2.37`.

Bumps the bundled Terraform binary to 1.16.6 (latest stable, [released
2026-10-14](https://github.com/hashicorp/terraform/releases/tag/v1.16.6))
so all supported branches ship the same version. Previous pin: 1.15.5
across `install.go`, `install.sh`, `scripts/Dockerfile.base`,
`mise.toml`/`mise.lock`, `flake.nix` and `testdata/version.txt`.

This is a minor version jump, so `maxTerraformVersion` is raised to
1.16.9. Checksums and Nix SRI hashes come from HashiCorp's
`terraform_1.16.6_SHA256SUMS`.

Verified with `go test ./provisioner/terraform/...` on this branch.

Opened by Superblink on behalf of @droopy4096.

_Updated from 1.16.5 to 1.16.6 (adds an HTTP/2 resource-exhaustion fix).
Branch name still says 1.16.5. Tests not re-run locally for 1.16.6,
relying on CI._

---------

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Makovey <[email protected]>

Backport of #30516 to `release/2.34`.

Bumps the bundled Terraform binary to 1.16.6 (latest stable, [released
2026-10-14](https://github.com/hashicorp/terraform/releases/tag/v1.16.6))
so all supported branches ship the same version. Previous pins were out
of sync: the shipped binary (`install.sh`, `scripts/Dockerfile.base`,
`mise`, `flake.nix`, `.github/actions/setup-tf`, `testdata/version.txt`)
was 1.15.5, while `TerraformVersion` in
`provisioner/terraform/install.go` was still 1.14.5. All are now 1.16.6.

This is a minor version jump, so `maxTerraformVersion` is raised to
1.16.9. Checksums and Nix SRI hashes come from HashiCorp's
`terraform_1.16.6_SHA256SUMS`.

Verified with `go test ./provisioner/terraform/...` on this branch.

Opened by Superblink on behalf of @droopy4096.

_Updated from 1.16.5 to 1.16.6 (adds an HTTP/2 resource-exhaustion fix).
Branch name still says 1.16.5. Tests not re-run locally for 1.16.6,
relying on CI._

---------

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Makovey <[email protected]>

Backport of #30516 to `release/2.36`.

Bumps the bundled Terraform binary to 1.16.6 (latest stable, [released
2026-10-14](https://github.com/hashicorp/terraform/releases/tag/v1.16.6))
so all supported branches ship the same version. Previous pins were out
of sync: the shipped binary (`install.sh`, `scripts/Dockerfile.base`,
`mise`, `flake.nix`, `testdata/version.txt`) was 1.15.5, while
`TerraformVersion` in `provisioner/terraform/install.go` was still
1.14.5. All are now 1.16.6.

This is a minor version jump, so `maxTerraformVersion` is raised to
1.16.9. Checksums and Nix SRI hashes come from HashiCorp's
`terraform_1.16.6_SHA256SUMS`.

Verified with `go test ./provisioner/terraform/...` on this branch.

Opened by Superblink on behalf of @droopy4096.

_Updated from 1.16.5 to 1.16.6 (adds an HTTP/2 resource-exhaustion fix).
Branch name still says 1.16.5. Tests not re-run locally for 1.16.6,
relying on CI._

---------

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Makovey <[email protected]>