ci: adopt staged policy Go 1.27.2 floor - #1066

Adopt the staged Go 1.27.2 floor for the isolated public-workflow policy analyzer. Restore the pinned module, checker, tests and wrapper, and rotate the three existing wrapper execution digests. This intentionally removes R4's budget-equivalence helper, fixture-reader plumbing and four associated tests now that the budget transition is adopted.

The reviewed head is 7248bad7c31fd6c4682f5b01474c5c3dda6ee7a2, based on accepted main 76e5dd595e10908e90eae6a27ddbfcd72a5baf62, with tree e4fc6c60a42844528c4c9968413b29e7a2bece4d. Exactly five files differ; all 3,527 nonowner files and modes, 38 staged pins, workflows, guard, harness and other trust maps are preserved. The failed 4e442b1b run remains in history, and its original resolver failure cause remains unproved.

Validation:

• Fresh local tests pass 59 checker and all 21 actual guard parents without filtering or caching. The real trusted-policy rejection → exact unchanged-guard marker → authorized candidate scan passes all 11 workflows. The full unchanged fixture harness and focused vet pass; its cached package checks are disclosed separately from the uncached regression run.
• CI38851613697 passes all 13 jobs and four required checks: 153 uncached packages, race/coverage/lint, 17 diagnostic parents, 18 resolver cases, 18 fixture contracts, eight capability parents, both real CLI compiler checks at Go1.27.2 and linked-version verification. The live Docker sandbox passes in 5.69 seconds with no failure diagnostic.
• CodeQL and Code Quality pass. Both independent Source2 and Own2 reviews finish with zero findings across all 15 bug classes.

The official OSV differential reports no added findings and 21 policytool-only removals; all 351 surviving finding objects are unchanged. Known loading failures leave analysis UNKNOWN, with no clean or complete security claim under the existing scoped timing decision. The benchmark's unsupported-listing failure remains advisory. Protected integration and actual-main/snapshot acceptance are the next checkpoint.