[cchu-ld]

Prepares the 2.18.4 release by hand, same approach as 2.18.3 in #623: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR.

Ships the Go 1.26.10 toolchain pin from #626, so crypto/x509 rejects chains through the distrusted eMudhra intermediates (INC-289, golang/go#82345). No code changes: only the version constant, the changelog and the Action metadata pins.

Also floats the uses: examples in build/metadata/github-actions/README.md on @v2, matching launchdarkly/find-code-references#68. Without this, the next sync to the Action repo would put back the exact-tag pins #68 removed. dockerImage keeps an exact tag.

Release steps after merge: Releasing the Code References tools. Two things differ from earlier notes:

• tag the squash commit of this PR, not main HEAD (main is already past fix(security): build with Go 1.26.10 for eMudhra intermediate distrust #626)
• after publishing the release, fix the Homebrew sha256 values from the release checksums.txt. The workflow writes the checksums from archives it discards, so the formula never matches the rebuilt assets. 2.18.3 is broken in brew right now for this reason (formula linux_amd64 7d001b26… vs release c30e3934…)

via LD Research 🤖

🤖 Generated with Claude Code

---

Note

Overview
Prepares 2.18.4 as a release-only PR: bumps internal/version/version.go, documents the release in CHANGELOG.md, and refreshes GitHub Action packaging pins to 2.18.4 (Action Dockerfile base image and docker/action.yml default dockerImage).

The changelog entry frames 2.18.4 as shipping builds on Go 1.26.10 so crypto/x509 rejects distrusted eMudhra intermediate chains, with no application logic changes in this diff.

GitHub Action docs/examples now reference launchdarkly/find-code-references@v2 and .../docker@v2 instead of exact v2.18.3 tags, while mirrored-registry examples still pin the scanner image tag to 2.18.4.

^{Reviewed by Cursor Bugbot for commit 53780d2. Bugbot is set up for automated code reviews on this repo. Configure here.}