[Pijukatel]

Summary

Syncs the Go client to OpenAPI spec v2-2026-10-20T121847Z (apify/apify-docs#3087, #3090, #3091, #3092, #3093, #3096). It also covers apify/apify-client-js#1143, #1146, #1162, #1164 and #1167 and the compromised intermediate CA certificates incident. Client version goes to 0.13.0.

• CA incident: the client has no custom TLS or CA code, so the fix is the Go toolchain.
  • CI and publish now build with Go 1.26.10, and go.mod gains toolchain go1.26.10.
  • golangci-lint goes from v2.5.0 to v2.15.0, because the old version can't load the toolchain line.
  • The go 1.23 minimum stays.
• Charge request ID: RunChargeOptions.RequestID is sent as requestId in the charge body, and left out when empty (#3092, JS #1162).
• Monthly usage: the new UserClient.MonthlyUsageWithOptions with MonthlyUsageOptions{Date} exposes the spec's date query parameter. MonthlyUsage(ctx) is unchanged.
• ActorEnvVar.Value: it is now always sent, because the API rejects env var writes without value.
  • Warning: the API never returns value for a secret. So an Update with an object fetched from the API now sets the secret to an empty value, where before it failed with a 400. This is documented in godoc, docs/actors.md and the CHANGELOG.
• Docs:
  • Actor Create behaviour: always private, non-empty versions, and SOURCE_CODE is not accepted.
  • A new version-definition section, and the schedule notifications field.
  • FLAT_PRICE_PER_MONTH is dropped from the store pricing-model filter values.
• Webhook tests: the live API now rejects ad hoc webhooks for made-up run IDs. Each test now creates its own task with a persistent webhook and cleans both up.
• No code change needed:
  • Request bodies are any, and unknown response fields land in Extra.
  • JS #1146 already matches how Go behaves.
  • JS #1143 is not applicable, because []byte bodies are already re-sent on retry.

All live integration, example and doc-snippet tests pass. gofmt, vet, build and golangci-lint are clean.