chore(release): bump Socket CLI to 2.6.0 in the heavy image

Version ref bump folded into the release PR (was briefly #103).

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Author: lelia

CHANGELOG.md

@@ -37,7 +37,7 @@ Socket's own supply chain.
   first run after upgrading.
 - OSS toolchain refresh: TruffleHog 3.96.0, OpenGrep v1.26.0 (SAST rule
   updates may shift findings), uv 0.12.1, gosec v2.28.0, Go 1.26.5
-  (app-tests), Socket CLI 2.5.8 (heavy image). Runtime bases (`python:3.12`,
+  (app-tests), Socket CLI 2.6.0 (heavy image). Runtime bases (`python:3.12`,
   `node:22`) are unchanged.
 - Docker Hub publish credentials are now scoped to the `publish` GitHub
   environment (deployment restricted to `main` and `v*` tags) instead of

Dockerfile.heavy

@@ -3,7 +3,7 @@ ARG PYTHON_VERSION=3.12
 ARG TRUFFLEHOG_VERSION=3.96.0
 ARG UV_VERSION=0.12.1
 ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_CLI_VERSION=2.5.8
+ARG SOCKET_CLI_VERSION=2.6.0
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b