ci: adopt Go 1.27.2 and verify native fixture compilers - #1061

Adopt the reviewed Go 1.27.2 wave across the six Workflow CI/release workflows and lint 2.14.0 in CI. Add the version-independent Go Tests result check.

Native fixture builds preserve the compiler captured at test startup and select GOTOOLCHAIN=local. The registry fallback now verifies Go build metadata on the actual CLI already compiled for the existing HostNegatives and Target consumers. A shared private command factory lets the isolated normal/PATH-trap contract check the same launcher and environment without two redundant CLI compilations. The existing 90-second build budget, race coverage, input/cache rules, provided Linux-host selection, credential filtering and default API CONNECT/TLS fixture remain.

Validation on the prepared source: all 18 fixture contract parents and 14 registry host/target parents pass with -race; focused vet and official lint 2.14.0 pass. Meaningful mutations prove that both the shared compiler probe and the metadata of a real compiled CLI reject forced Go 1.26.5, and that an ambient PATH launcher is caught. Restored real CLI metadata identifies Go 1.27.2.

The previous published source 209f362 had 152 successful package results, all eight capability fixtures and 17 of 18 contracts passing, with full Linux lint successful. Its additional standalone normal CLI build hit the unchanged 90-second budget; no global test timeout or resource/cold-cache cause was established. This change addresses that measured redundancy. Fresh natural candidate CI has now succeeded for source 949c681.

Task11 remains unaccepted pending the separate settings owner, ordinary PR/main readbacks and applicable snapshot gates. Required rules remain unchanged, including the strict legacy Test (Go 1.26.5) check gap. A separately reviewed settings owner may switch that exact requirement only after genuine native153/eight/all18/full Linux lint success and exact-source Actions app15368 Go Tests SUCCESS. No merge, release, deployment or runtime acceptance is claimed here. Earlier CI/review failures remain retained; the latest explicit direction authorizes this visibly monotonic source6/own6 continuation. OSV comparison has no differential result but retains 14 base and 14 candidate analysis errors; advisory benchmark evidence is not performance acceptance.

Fresh Linux evidence: all153 package results, all8 capability fixtures and all18 contract parents PASS; actual registry CLI metadata identifies go1.27.2 in both HostNegatives and Target consumers; discovery integration PASS; full Linux lint0. Native cmd/wfctl result456.302s retains the existing package/build budgets. Native tests and exact-source Actions app15368 Go Tests SUCCESS. The provider-tested merge ba82373 has exacttreec8be3714/orderedparents97caf20/949c681. Full13 effective rule objects remain unchanged/strict, with only required Test (Go 1.26.5)/Actions15368 missing; no waiver or settings change occurred. OSV official JSON remains byte-identical with0 differential results and14+14 analysis errors. Advisory benchmark listing failure remains disclosed without performance acceptance.