#1342 fix(server): disable Multipath TCP on listeners

Sets godebug multipathtcp=0 in go.mod, so GoModel's Linux listeners no longer use MPTCP. This blocks the known exploit path for the Linux kernel use-after-free CVE-2026-98432 (Go advisory, go.dev/issue/82717).

This is a mitigation, not a fix: the kernel bug isn't specific to MPTCP, so hosts still need a patched kernel.

User impact

• MPTCP clients fall back to regular TCP. Outbound provider connections don't change, since Go already leaves MPTCP off for them.
• GODEBUG=multipathtcp=2 turns it back on for listeners.
• Custom binaries built from the run package don't inherit this setting, so they need //go:debug multipathtcp=0 directly before package main. The docs now say so. A go.mod line would be ignored in workspace mode, but this works in both.
• Images and binaries already released stay exposed until upgraded. They can set GODEBUG=multipathtcp=0 in the environment without a rebuild.

Testing

• go test ./... passes.
• The builder stages of Dockerfile and Dockerfile.plugins both produce a binary with DefaultGODEBUG=multipathtcp=0.
• Not observed at runtime, because the Docker Desktop kernel has no MPTCP support.

Summary by CodeRabbit

• Security
  • Multipath TCP is disabled for GoModel’s Go binary. A patched Linux kernel is still required to address CVE-2026-98432.
• Documentation
  • Guidance in English, German, Polish, and Chinese clarifies that custom binaries must set this option independently; GoModel’s setting does not carry over to other modules.