*: backport bugfixes to v1.11.1-rc2

[KaloyanTanev]

Backports the following fixes to the v1.11 release branch for v1.11.1-rc2:

• app/sse: invalidate duties on dependent root mismatch (app/sse: invalidate duties on dependent root mismatch #4774)
• *: bump golang.org/x/net to v0.60.0 (*: bump golang.org/x/net to v0.60.0 #4775) — fixes GO-2026-6617 and GO-2026-6612; resolved against this branch's go.mod, which also carries x/crypto 0.55→0.57, x/sync 0.22→0.23, x/term 0.45→0.46, x/text 0.41→0.42, x/mod 0.39→0.41 and x/sys 0.47→0.48.
• core/consensus: reject leader duties unknown locally (core/consensus: reject leader duties unknown locally #4773)

category: bug
ticket: none

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 96.10390% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.41%. Comparing base (6dc97a8) to head (887a99c).

Files with missing lines	Patch %	Lines
app/sse/listener.go	95.74%	1 Missing and 1 partial ⚠️
app/app.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff               @@
##           main-v1.11    #4777      +/-   ##
==============================================
+ Coverage       58.37%   58.41%   +0.04%     
==============================================
  Files             247      247              
  Lines           34136    34192      +56     
==============================================
+ Hits            19926    19974      +48     
- Misses          11733    11741       +8     
  Partials         2477     2477              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.