Add Hammerhead Karoo provider

[bzimmer]

Summary

• Adds a new hammerhead package implementing a client for the Hammerhead Karoo API
• Supports OAuth 2.0 authorization code flow with rotating refresh tokens (activity:read scope)
• Implements the activity.Exporter interface via ActivitiesService: list activities, fetch a single activity, and download the original FIT file
• Fixes a pre-existing goconst lint failure in strava/encoding.go (repeated "1.1" literal extracted as gpxVersion constant)
• Bumps go directive from 1.26.2 to 1.26.5 to resolve five stdlib CVEs (GO-2026-4971, GO-2026-4918, GO-2026-5039, GO-2026-5037, GO-2026-5856) reachable via zwift and strava code

New files

• hammerhead/model.go — Fault, ActivitySummary, Activity, ActivitiesPage types
• hammerhead/hammerhead.go — Client, Endpoint(), OAuth helpers
• hammerhead/hammerhead_with.go — NewClient and all With* option functions
• hammerhead/activities.go — ActivitiesService with Activities, Activity, File, Export

---

Generated by Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 98.72611% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.57%. Comparing base (897fb10) to head (b9f5e11).

Files with missing lines	Patch %	Lines
hammerhead/hammerhead.go	94.73%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #39      +/-   ##
==========================================
+ Coverage   81.94%   83.57%   +1.63%     
==========================================
  Files          35       40       +5     
  Lines        1429     1583     +154     
==========================================
+ Hits         1171     1323     +152     
- Misses        144      145       +1     
- Partials      114      115       +1     

Files with missing lines	Coverage Δ
hammerhead/activities.go	100.00% <100.00%> (ø)
hammerhead/auth.go	100.00% <100.00%> (ø)
hammerhead/hammerhead_with.go	100.00% <100.00%> (ø)
hammerhead/model.go	100.00% <100.00%> (ø)
strava/encoding.go	87.34% <100.00%> (ø)
hammerhead/hammerhead.go	94.73% <94.73%> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 897fb10...b9f5e11. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.