build(deps): consolidate the Go toolchain pin on 1.27.0

[bketelsen]

Summary

Moves every Go toolchain dependency surface in this repository from 1.26.7 to
1.27.0 in a single change. Resolves Snowcat item
efb7e1fc-2678-49ed-9b76-825fbafaaeee (dependencies-gap-fix).

The surfaces have to move together: the worker base image sets
GOTOOLCHAIN=local, so a go.mod toolchain the image's Go cannot satisfy
fails at the first go invocation inside a lease rather than downloading a
toolchain.

• go.mod — toolchain go1.27.0. The go 1.26.6 language/compatibility
  directive is deliberately unchanged; nothing here needs 1.27 language
  semantics, and raising it would narrow who can build the module.
• mise.lock — regenerated with mise lock. mise.toml never pins Go
  (idiomatic_version_file_enable_tools = ["go"]), so mise reads the same
  go.mod toolchain line; the lock now resolves Go 1.27.0 across all seven
  locked platforms. Each checksum matches upstream https://go.dev/dl/?mode=json
  for go1.27.0 (verified linux-amd64/arm64, darwin-amd64/arm64, windows-amd64).
  golangci-lint 2.13.1 and actionlint 1.7.12 are untouched.
• .github/workflows/release.yml, .github/workflows/snapshot.yml — the
  setup-go pin.
• oci/Containerfile — both the fetch and base stages move to
  docker.io/library/golang:1.27.0-bookworm at its immutable
  multi-architecture manifest digest
  sha256:ded31c68586d2e49e760acc2e65a884b23d032e9bbbed0ae0c55abd3fcaf4452
  (confirmed with skopeo inspect; the index carries linux/amd64 and
  linux/arm64). The node:26-bookworm-slim digest and every fetched-binary
  checksum are unchanged.
• oci/baseline.json — base, tools.go, tools.gofmt.
• docs/specs/oci-workers.md — the reader-facing base pin.
• internal/worker/worker_test.go — the literal provisioning fixtures and the
  expected go@<version> provisioning tool string.

docs/adr/0012-… still says Go 1.26.7: that is its historical record of what
worker image v0.1.1 contained, and Accepted ADRs are immutable.

golangci-lint 2.13.1 is already built with Go 1.27.0, so the Makefile's
lint-version-check guard (golangci-lint must be built with a Go at least as
new as the toolchain) still passes without a lint bump.

Risk tier

Risk tier: Medium — a toolchain and base-image dependency bump that changes
what every worker image and CI job compiles with. It touches no credential
projection, worker authority, networking, or lifecycle code, but a wrong or
partial pin would break worker leases at their first go invocation, so it is
not docs-only risk. Every reference is verified against upstream (release
checksums, image manifest digest) and the built image was executed.

Boundary check

• Snowcat's MCP contract and databases remain untouched
• No provider, MCP, GitHub, or lease credential enters args, logs, or state
• Writable terminal surfaces remain loopback-only
• Cleanup remains an explicit operator action

Docs housekeeping

• New docs started from their category TEMPLATE.md — n/a, no new docs
• Every new canonical doc is indexed in docs/README.md — n/a, no new docs
• ADR, design, spec, and plan links run both ways — no links changed;
  make docs-check reports 32 docs, 315 links, 10 symlinks all green
• Conformance aliases in ADR-0007 were not edited as content

Verification

• make ci — passes end to end with the pinned tools installed
  (mise install; Go 1.27.0, golangci-lint 2.13.1, actionlint 1.7.12):

  golangci-lint run
  0 issues.
  GOCACHE=/tmp/snowcat-cockpit-gocache go test ./...
  ok  github.com/frostyard/snowcat-cockpit/internal/worker  0.168s
  ...
  PASS: observer wrapper
  PASS: OCI entrypoints
  PASS: cockpit lifecycle
  GOCACHE=/tmp/snowcat-cockpit-gocache go test -race -short ./...   (all ok)
  GOOS=linux GOARCH=amd64 ... go build -trimpath -o /tmp/snowcat-cockpit-linux-amd64
  GOOS=linux GOARCH=arm64 ... go build -trimpath -o /tmp/snowcat-cockpit-linux-arm64
  node scripts/check-docs.mjs
  ok   docs_index_coverage: 1.000 (required 1)
  ok   link_integrity: 1.000 (required 1)
  ok   symlink_resolution: 1.000 (required 1)
  checked: 32 docs, 315 links, 10 symlinks
  actionlint
  (exit 0)
  

• Workflow changes pass actionlint — via make workflow-lint in the
  make ci run above.

• Every action is SHA-pinned with a version comment and checkout disables
  persisted credentials — unchanged in this PR; only the go-version
  input strings moved.

• mise outdated --bump → mise All tools are up to date (it previously
  reported the Go toolchain as behind at 1.26.7).

• Worker image built and executed (docker build --build-arg TARGETARCH=amd64 --file oci/Containerfile --target codex, exit 0), then
  run:

  go version go1.27.0 linux/amd64
  baseline.base   docker.io/library/golang:1.27.0-bookworm
  baseline.tools.go / .gofmt  1.27.0
  OK: image go matches baseline.tools.go
  codex-cli 0.149.0 / 2.1.239 (Claude Code) / GitHub Copilot CLI 1.0.80.
  node v26.7.0 / mise 2026.8.12