ci: stage isolated policy Go 1.27.2 floor - #1064

The seven workflow compiler contexts have completed their separate Go 1.27.2 transition in PR1063. This stages the final isolated policy-module floor change without adopting or promoting it.

Only .github/public-workflow-authority.json changes. The active 38-file bundle remains exact. The staged 38-file bundle keeps the same ordered membership and changes exactly two hashes: policytool/go.mod for go 1.26.5 to go 1.27.2, and the wrapper hash resulting from that embedded module-hash update. The module, wrapper, sum, immutable guard, executable trust rows, workflows and every other source file remain unchanged. The staged future source is intentionally unrealized; adoption and promotion remain separate Tasks24 and25.

Validation: all 3,530 source files and modes were frozen against accepted main b0195f9, including the 62 owning predecessor inputs. Actual Go1.27.2/local native checks passed the trusted stage, nonzero first adoption scan, unchanged guard exact authorization marker, authorized candidate self-scan, ordinary promotion scan, 12 refusal/rollback controls, unchanged full policy fixture harness, vet, actionlint and compatible official golangci-lint2.14.0 for the isolated policy module. A process-level shared-cache sandbox failure is preserved alongside the successful approval-reviewed rerun; no cache or source permissions changed.

Hosted exact-head CI, security, protections and snapshot/main acceptance remain separate gates. The prior incomplete OSV result and its findings are not claimed fixed or clean; benchmark failures remain advisory under B14, with no performance credit. Release/dependency-update runtime remains config-only until natural events. SourcePR1022, stable CLI publication and Compute runtime acceptance remain separate.

Locked plan: Task23, docs/plans/2026-10-04-workflow-go127-ci.md; 29 task/PR identities and all scope locks are unchanged.