fix(deps): support Go 1.27 in benchmark startup dependencies - #1090

Benchmark discovery fails before performance comparison because Sonic 1.15.2 emits a compatibility warning when Workflow runs on Go 1.27. Upgrade Sonic to 1.15.4 and its required loader to 0.5.2 in both the root and example module graphs. Add a real package-initialization regression that rejects startup diagnostics rather than filtering them out.

The dependency versions select Sonic's supported native Go 1.27 implementation. This changes the prior JSON fallback path, so runtime serializer validation is included. The benchmark workflow, strict validator, baseline cache, six-sample requirement, permissions, and release policy are unchanged.

This is a standalone change from main; it does not include the diagnostic changes in #1089.

Regression evidence

The test re-executes the actual root test binary with -test.list=^$, including real dependency initialization, and rejects any stdout/stderr or failed subprocess.

Original Sonic 1.15.2 / loader 0.5.1: FAIL
package initialization polluted benchmark discovery output:
WARNING: sonic/ast only supports (go1.17~1.26 and amd64 CPU) or (go1.20~1.26 and arm64 CPU), but your environment is not suitable and will fallback to encoding/json

Sonic 1.15.4 / loader 0.5.2: PASS
Revert dependency files only: FAIL with the same warning
Restore reviewed dependency files: PASS

Validation

• Go 1.27.2 Darwin/arm64: full root package and actor tests pass; 14 native GoAkt JSON serializer tests pass, including malformed input, round trips, and concurrency.
• Actual all-package benchmark discovery passes with 28 benchmark roots and no diagnostics. This is discovery, not performance evidence.
• Root/actor vet, module checksum verification, formatting and whitespace checks pass.
• Root and example go mod tidy -diff are checked; the example module's matching version/checksum updates prevent CI drift.
• The unchanged parser still rejects the original and injected diagnostics. Its accepted reference fixture is explicitly parser-only, not a new candidate measurement or performance result.
• Independent local review binds the final changed files and reports no blocking code findings. Hosted Linux and complete PR checks are the remaining execution gates.

Doc-reconciliation: clean.

Benchmark and merge holds

The prior hosted artifact used an AMD EPYC 9V74 candidate and AMD EPYC 7763 cached baseline. The strict validator includes CPU identity; those datasets cannot establish a valid comparison. This PR leaves that requirement intact. Its ordinary PR benchmark run will provide fresh evidence, but a missing or incompatible baseline must not be presented as a performance pass.

Keep this PR in draft. Every normal push to main triggers automatic snapshot release/tag deletion and a new snapshot/GHCR publication. Those effects are not authorized for this change. No release, snapshot deletion, profile installation, manual workflow rerun, or branch-protection bypass is requested.